---
id: CVE-2025-58403
title: Reflected Cross-Site Scripting (XSS) in CGM CLININET
summary: >-
  CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to
  improper neutralization of user-supplied data. A remote unauthenticated
  attacker can craft a malicious URL containing JavaScript or HTML code, which
  is executed in…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: CGM
product: CGM CLININET
affected:
  - clininet <= 2025.MS3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T17:48:38.782471Z'
published: '2026-10-23'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T20:02:37.736Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-58403'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2025-30043/'
  - url: 'https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html'
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2025-58403/'
tags:
  - cve.org
epss: 0.005
epssPercentile: 0.42777
ingestedAt: '2026-10-23T09:20:44.062Z'
---

## Overview

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application.



The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

## Affected

- `clininet <= 2025.MS3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.