Asseco Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Asseco products.

Products

Showing 5 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Improper Restriction of XML External Entity Reference in proCertum SmartSign

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”. This issue was fixed in version 9.4.3.90.

CWE-611Jul 27, 2026
CVSS4.8v4.0EPSS0.135%PoCs0SignalsSTIX

Arbitrary Path Execution via CPS URI in proCertum SmartSign

proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90.

CWE-73Jul 27, 2026
CVSS4.6v4.0EPSS0.085%PoCs0SignalsSTIX

Information disclosure via IDOR in Asseco AMDX

Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX.

CWE-639Jan 8, 2026
CVSS5.3v4.0EPSS0.292%PoCs0SignalsSTIX

Recoverable passwords in Asseco Infomedica Plus

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software.  This vulnerability has been fixed in versions 4.50.1 and 5.38.0

CWE-257Jan 8, 2026
CVSS5.9v4.0EPSS0.107%PoCs0SignalsSTIX

Improper Access Control in Asseco Infomedica Plus

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control.  Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

CWE-1220Jan 8, 2026
CVSS5.1v4.0EPSS0.145%PoCs0SignalsSTIX