CVE-2025-64778
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
Risk Assessment
Risk of unauthorized access to the application and database, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately change all hard-coded passwords to secure authentication mechanisms and update the software to the latest version.
Other vulnerabilities in NMIS/BioDose
See all- CVE-2025-64642High
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
- CVE-2025-64298High
NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.
- CVE-2025-62575High
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.
- CVE-2025-61940High
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Original NVD description (English source)
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS