---
id: "CVE-2026-112172"
page: "https://infrastack.ai/live/CVE-2026-112172"
kind: "vulnerability"
aliases: ["CVE-2026-112172"]
title: "CGM XDent and XMedical: unauthenticated SQL injection via sync endpoints"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "CGM XDent and XMedical", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "CGM XDent", "fixed": [], "affected": "< 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree", "ecosystem": "vendor"}, {"name": "CGM XMedical", "fixed": [], "affected": "< 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-xdent", "cgm-xmedical", "healthcare", "mysql", "php", "sql-injection", "vendor"]
not_affected_if: []
published_at: "2026-11-09T12:16:35+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:31:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112172", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T12:31:29+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.apocert.it/pubblicazioni/xdent-xmedical-avviso-sicurezza-sincronizzazione", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CGM XDent and XMedical: unauthenticated SQL injection via sync endpoints

Link for people: https://infrastack.ai/live/CVE-2026-112172 (this .md is for agents)

CGM XDent and XMedical expose PHP synchronization endpoints that accept requests without login. An attacker can change session variables and run arbitrary SQL queries against the backend MySQL database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM XDent and XMedical affected range not listed fixed no fixed version listed
- vendor:CGM XDent affected < 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree fixed no fixed version listed
- vendor:CGM XMedical affected < 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree fixed no fixed version listed

## How to check

No local file or version proves the fix, since the flaw is in a central synchronization service. Ask CGM which XDent/XMedical version and sync service you use and whether the fix is applied. Confirm the sync endpoints reject unauthenticated requests and check that the database is not reachable from outside. Review logs from before the fix for unusual access. Do not scan the vendor's servers without authorization (ApoCert).

## Fix

No fixed version published. CGM Italia says fixes were distributed automatically to affected installations; confirm with CGM customer service that your install and the sync service are updated.

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112172
- 2026-11-09T12:31:29+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — NVD lists XDent/XMedical <4.4.0 (no CPE); CSIRT Italia (ACN) lists 4.4.0 as affected - the two disagree, unresolved. No fixed version named anywhere. CGM Italia says fixes were distributed automatically (its page doesn't name XDent/XMedical); ApoCert says the vendor declared it resolved and the sync service is central, so the local version doesn't prove the fix. No exploitation or PoC found. Exa credits exhausted; ACN's CVE-to-product mapping is not explicit, and ApoCert ties it to this CVE. Nothing verified: no vendor advisory read.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [describes] ApoCert: XDent/XMedical sync security notice https://www.apocert.it/pubblicazioni/xdent-xmedical-avviso-sicurezza-sincronizzazione
- [fix] CGM Italia: fixes distributed automatically, with CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_