Compugroup Medical Profim
9 CVEs affecting Compugroup Medical Profim. Latest disclosed: 2026-11-09. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-118795 | | 2026-11-09 | Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. | |
CVE-2026-118468 | | 2026-11-09 | XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity… | |
CVE-2026-118467 | | 2026-11-09 | Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate ps… | |
CVE-2026-118465 | | 2026-11-09 | Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. | |
CVE-2026-118464 | | 2026-11-09 | Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, co… | |
CVE-2026-118462 | | 2026-11-09 | Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also… | |
CVE-2026-118461 | | 2026-11-09 | The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials. | |
CVE-2026-118460 | | 2026-11-09 | Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized… | |
CVE-2026-118459 | | 2026-11-09 | A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials. |