CVE-2025-30036CWE-79
Stored XSS permitting session takeover of arbitrary user
High · published August 27, 2025
What it is
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.
The record
Technical detail
- CVSS v4.0
- 8.8 · HIGH
- Vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS
- 0.00160 · 4.8th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2025-08-27T10:19Z
EPSS history
Timeline