What’s Vulnerable › Vulnerabilities
CVE-2025-30036: Stored XSS permitting session takeover of arbitrary user
- Severity: high (CVSS 8.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-27 · updated 2026-06-17
- Weakness: CWE-79
Description
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.
Affected products
- CGM CLININET: before 2024.MS4 — fixed in 2024.MS4
How to fix
Upgrade to a fixed version: CGM CLININET 2024.MS4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-30036 or the next vulnerability affects your stack