Description
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Published: 2026-11-09
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

CGM XDent and XMedical expose PHP synchronization endpoints that allow attackers to manipulate session variables without authentication, enabling arbitrary SQL queries against the MySQL back‑end. This can lead to confidential data disclosure, data tampering, or deletion, essentially compromising confidentiality and integrity of the medical records held by the system.

Affected Systems

The vulnerability affects CompuGroup Medical XDent and CompuGroup Medical XMedical. All deployed versions that contain the exposed PHP synchronization modules are considered vulnerable; no specific version restrictions are listed.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no publicly known exploits yet. Attackers could exploit the flaw over the network by sending crafted requests to the exposed synchronization endpoints, which do not require authentication. Built‑in session handling and lack of input validation make the exploitation straightforward once the endpoint is reachable.

Generated by OpenCVE AI on November 9, 2026 at 12:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest CompuGroup Medical patch or update that fixes the unauthenticated SQL injection flaw for XDent and XMedical.
  • If a patch is not yet released, restrict network access to the PHP synchronization endpoints by configuring firewalls or access control lists so only trusted internal hosts can reach them.
  • Modify the endpoint configuration to enforce authentication for all incoming requests and validate or sanitize session variables before using them in SQL statements, preferably using parameterized queries.

Generated by OpenCVE AI on November 9, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Compugroup Medical
Compugroup Medical xdent
Compugroup Medical xmedical
Vendors & Products Compugroup Medical
Compugroup Medical xdent
Compugroup Medical xmedical

Mon, 09 Nov 2026 12:00:00 +0000

Type Values Removed Values Added
References

Mon, 09 Nov 2026 11:45:00 +0000

Type Values Removed Values Added
Description CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Title Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y'}

Subscriptions

Compugroup Medical Xdent Xmedical
cve-icon MITRE

Status: PUBLISHED

Assigner: ENISA

Published:

Updated: 2026-11-09T11:45:11.226Z

Reserved: 2026-10-19T08:06:39.208Z

Link: CVE-2026-112172

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T12:16:35.170

Modified: 2026-11-09T12:16:35.170

Link: CVE-2026-112172

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T16:36:32Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')