CVE-2025-12921

MediumCVSS 4.3

Published: 10/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

43th percentile - higher than 43% of all known CVEs

Summary

A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects some unknown functionality of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument leads to xml injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

Risk Assessment

The risk involves the possibility of manipulating XML data, potentially leading to data integrity compromise or further attacks.

Recommendation

It is recommended to immediately restrict access to the CRF import functionality and apply vendor patches. Also validate input data.

Other vulnerabilities in OpenClinica Community Edition

CVE-2025-12922Medium
A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects an unknown part of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument results in path traversal. The attack can be initiated remotely, and the exploit has been made public.

Original NVD description (English source)

A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads to xml injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS