Vulnerabilidades de Asseco
CVEs publicadas que afetam produtos de Asseco: 4 registro(s), com severidade, exploração e correções.
CVE-2025-66955
Média · 6.5
CWE-552 12/03/2026
Files or Directories Accessible to External Parties em Asseco Live
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.
CVE-2025-4596
Média · 5.3
CWE-639 08/01/2026
Information disclosure via IDOR in Asseco AMDX
Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs.
This issue has been fixed in 6.09.01.62 version of ADMX.
CVE-2025-8307
Média · 5.9
CWE-257 08/01/2026
Recoverable passwords in Asseco Infomedica Plus
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software.
This vulnerability has been fixed in versions 4.50.1 and 5.38.0
CVE-2025-8306
Média · 5.1
CWE-1220 08/01/2026
Improper Access Control in Asseco Infomedica Plus
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control.
Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0