OS command injection in CGM CLININET (CVE-2025-30044)

CGM CLININET contains an OS command injection vulnerability in four CGI endpoints (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, and dblogstat.pl) where input parameters are not sufficiently normalized. This flaw enables an attacker to inject and execute arbitrary operating system commands through these endpoints. Affected versions: - All before 2025.MS2 We recommend updating to: 2025.MS2. CVSS 9.4 · our assessment: act_now Reference: https://cert.pl/en/posts/2026/03/CVE-2025-10350/ Details: https://vuln.today/cve/CVE-2025-30044