Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-58405: CGM CLININET application is vulnerable to clickjacking attacks
CVE-2025-58405 · published 8 months ago
Summary
The CGM CLININET application can be tricked into performing unintended actions when embedded in a fake webpage. This could lead to users unknowingly making changes or taking actions that they didn't intend to. To fix this, implement HTTP security headers or HTML-based protections to prevent clickjacking attacks.
What to do
- Update cgm clininet to version 2025.ms3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cgm | clininet |
< 2025.ms3 cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:* |
Original advisory text
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, ...
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1021Improper Restriction of Rendered UI Layers or Frames
Timeline
Published2 Mar 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-58405 · NVD
Track software like this
Free during beta