CVE-2025-35029CWE-79cross-site-scripting

CVE-2025-35029

Low · published November 21, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-21T01:16Z
Affected products (4)
ProductVersionsFixed in
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
mieweb/enterprise_healthall versions—
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-35029 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 20 NOV 19:34Z
    Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page
    cvelistv5