CVE-2025-30055
Conditional RCE via the "system" function
- State
- Published
- Severity
- 9.0 Critical
- Published
- Aug 27, 2025
- Updated
- Aug 27, 2025
- Reserved
- Mar 14, 2025
Description
The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.0 Critical | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CERT-PL |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
CGM CLININETCGM |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.