CVE-2025-58403

Reflected Cross-Site Scripting (XSS) in CGM CLININET

State: Published
Severity: 5.1 Medium
Published: Oct 23, 2026
Updated: Oct 28, 2026
Reserved: Sep 1, 2025

Description

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application.

The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	CERT-PL

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
CGM CLININETCGM	2025.MS3 and earlierAffected

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.htmlproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.