cert.plThird-party advisory
https://cert.pl/en/posts/2026/01/CVE-2025-8306 CVE-2025-8307
MEDIUM
Recoverable passwords in Asseco Infomedica Plus
Record summary
CVE-2025-8307 has a selected CVSS score of 5.9 (medium).
Description
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
InfoMedica PlusBrowse Asseco / InfoMedica PlusDefault status: unaffected | CVE List | 5.0.0 to < 5.38.0 | affected |
| 4.0.0 to < 4.50.1 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-8307