CVE-2025-10350
SQL injection in CGM NETRAAD
- State
- Published
- Severity
- 8.8 High
- Published
- Mar 2, 2026
- Updated
- Mar 2, 2026
- Reserved
- Sep 12, 2025
Description
SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L | CERT-PL |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
CGM NETRAADCGM |
|
References
- https://cert.pl/en/posts/2026/03/CVE-2025-10350/third-party-advisory
- https://www.cgm.com/pol_pl/products/szpital/cgm-netraad.htmlproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.