| TVN ID | TVN-202508006 |
|---|---|
| CVE ID | CVE-2025-8857, CVE-2025-8858 |
| CVSS | CVE-2025-8857： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-8858： 7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Affected Products | Clinic Image System version 2.4.23.2131 and earlier, excepet for version 1.5.x.x and 2.0.x.x. |
| Description | Hard-coded Credentials(CVE-2025-8857)： Unauthenticated remote attackers can log into the system using administrator credentials embedded in the source code.。 SQL Injection(CVE-2025-8858)： Unauthenticated remote attackers can inject arbitrary SQL commands to read database contents. |
| Solution | Update to version after 2.4.23.2131 |
| Credit | Sam Huang(CHT Security) |
| Public Date | 2025-08-29 |
:::