---
id: CVE-2025-58403
title: Reflected Cross-Site Scripting (XSS) in CGM CLININET
summary: >-
  CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to
  improper neutralization of user-supplied data. A remote unauthenticated
  attacker can craft a malicious URL containing JavaScript or HTML code, which
  is executed in…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: CGM
product: CGM CLININET
affected:
  - clininet <= 2025.MS3
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T09:31:38.531Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-58403'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2025-30043/'
  - url: 'https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html'
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2025-58403/'
tags:
  - cve.org
ingestedAt: '2026-10-23T09:20:44.062Z'
---

## Overview

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application.



The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

## Affected

- `clininet <= 2025.MS3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.