CVE-2025-30036 — Stored XSS permitting session takeover of arbitrary user

CVE-2025-30036

Stored XSS permitting session takeover of arbitrary user PUBLISHED

Description (CNA)

Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.

Affected (CNA)

Vendor / product	Versions
CGM / CGM CLININET	affected 0 before 2024.MS4

CWE

CWE-79

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.