CVE-2025-12921CWE-74CWE-91

CVE-2025-12921

Medium · published November 10, 2025

CVSS v3.1
4.3
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads to xml injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00574 · 46.7th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2025-11-10T05:15Z
Affected products (2)
ProductVersionsFixed in
openclinica/openclinicaall versions—
openclinica/openclinicaall versions—
References (7)
https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md · [email protected]https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md#poc · [email protected]https://vuldb.com/?ctiid.331641 · [email protected]https://vuldb.com/?id.331641 · [email protected]https://vuldb.com/?submit.680872 · [email protected]https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md#poc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 NOV 23:32Z
    OpenClinica Community Edition CRF Data Import ImportCRFData xml injection
    cvelistv5