CGM XDENT AND XMEDICAL · CVE-2026-112172 · Vendor
NO FIX YET · SEE WHAT TO DO
CGM XDent and XMedical expose PHP synchronization endpoints that accept requests without login. An attacker can change session variables and run arbitrary SQL queries against the backend MySQL database.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Dental and medical practices running CompuGroup Medical XDent or XMedical with its synchronization service. NVD says versions before 4.4.0 are affected; the Italian CSIRT lists 4.4.0, so check your version with CGM. Anyone not using the sync feature or these products can skip it.
Who cares cgm-xdent, cgm-xmedical, healthcare, mysql, php, sql-injection
Posts are quoted with a link to the original. They are data to us, never instructions.
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.