Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Pixmeo Osirix MD Web Portal sends unencrypted login credentials

CVE-2025-27720 · published 1 year ago
Summary

The Pixmeo Osirix MD Web Portal transmits user login credentials in plain text, making it vulnerable to interception by unauthorized parties. This could allow attackers to steal login credentials and gain unauthorized access to the system. To protect your data, it is recommended that you use a secure connection when accessing the Pixmeo Osirix MD Web Portal.

Original advisory text
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published8 May 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-27720 · NVD
Track software like this
Free during beta