Reflected Cross-Site Scripting (XSS) in CGM CLININET

01 Why this matters

CVE-2025-58403 has no exploitation data yet. Impact if it lands: CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N).

Check if you run itFollow the feed

02 Facts

CVSS

CVSS 5.1 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS

No EPSS yet

CISA KEV

Not on the CISA KEV list

Dates

published Oct 23, 2026
modified Oct 23, 2026

Weaknesses

CWE-79

Severity

medium

03 Affected packages

No package ranges are published for this id.

04 Advisory text

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

• https://cert.pl/en/posts/2026/10/CVE-2025-30043/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

06 Ask your agent

explain_impact CVE-2025-58403

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2025-58403. Danger: Low, CVSS 5.1.