What’s Vulnerable › Vulnerabilities
CVE-2018-25142: NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-24 · updated 2026-06-17
- Weakness: CWE-611
Description
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.
Affected products
References
- https://www.exploit-db.com/exploits/45337
- https://www.novarad.net
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
- https://www.exploit-db.com/exploits/45337
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
Get alerted when CVE-2018-25142 or the next vulnerability affects your stack