CVE-2025-35030

HighCVSS 8.1

Published: 29/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in Medical Informatics Engineering Enterprise Health allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on their behalf. The issue is fixed as of 2025-04-08.

Risk Assessment

An attacker can perform unauthorized administrative actions, potentially leading to data breaches and system configuration changes.

Recommendation

Ensure the system is updated to a version after 2025-04-08 to eliminate the CSRF vulnerability.

Other vulnerabilities in Medical Informatics Engineering Enterprise Health

CVE-2025-35033Medium
Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

Original NVD description (English source)

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS