What is GHSA-v266-hpvv-qc3w?

GHSA-v266-hpvv-qc3w is a security advisory published by GitHub Security Advisories with High severity. CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers...

Which CVE IDs does GHSA-v266-hpvv-qc3w cover?

GHSA-v266-hpvv-qc3w covers the following CVE IDs: CVE-2026-112172. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-v266-hpvv-qc3wHigh

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-112172 →

📋 Description

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-112172
https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
https://github.com/advisories/GHSA-v266-hpvv-qc3w