CGM CLININET EUVD-2025-211185

Exploitation requires that an authenticated CGM CLININET user (e.g., a clinician with an active session) be socially engineered into visiting an attacker-crafted URL - the UI:A metric confirms required user interaction, which is the primary limiting factor. No special product configuration is named in the description; the flaw stems from improper neutralization of user-supplied data reflected into the response, so it applies to the standard web interface of affected versions (confirmed up to 2026.MS3, with later versions possibly affected). The impact is bounded to the victim's browser session (session-cookie theft and actions as the victim), not direct server compromise. No authentication is needed by the attacker to craft the link (PR:N), but successful payload execution depends on a valid victim session existing when the link is opened.

This is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity, unauthenticated reflected XSS that nonetheless requires victim interaction (UI:A) - the victim must visit an attacker-crafted URL - and impact is confined to the subsequent system (browser session) with SC:L/SI:L and no confidentiality/integrity/availability impact on the application server itself (VC:N/VI:N/VA:N), yielding a medium base score of 5.1. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency issue. No EPSS score was provided, the vulnerability is NOT on CISA KEV, and no proof-of-concept or exploit reference is present among the references (only the CERT-PL advisory and the vendor product page). The signals are internally consistent - there is no CVSS-versus-description conflict - and all point to a genuine but interaction-dependent, session-scoped web flaw rather than a wormable server compromise. Note: no EPSS value was supplied, so widespread-scanning probability cannot be quantified from the input.

An attacker crafts a URL for the CGM CLININET application containing malicious JavaScript in a reflected parameter and delivers it to a logged-in clinician via phishing email or chat. When the victim opens the link, the script executes in their authenticated browser session, letting the attacker steal session cookies and perform actions in the application as that user. No public exploit code or PoC reference was identified in the provided data.