CVE-2026-25860EPSS p23.5%

CVE-2026-25860CVE-2026-25860

Description

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.

Scoring

CVSS 6.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS0.33% probability of exploitation · percentile 23.5% · 2026-10-05T12:00:23Z
Last modified2026-07-23

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-5728
CVE
CVE-2026-32118
CVE
CVE-2025-9772
CVE
CVE-2026-46518
CVE
CVE-2025-5943
CVE
CVE-2026-34416
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.