Back to overview

CVE-2018-25142

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

Metadata

CVE ID
CVE-2018-25142
State
PUBLISHED
Assigner
VulnCheck
Reserved
2025-12-24 14:28 UTC
Published
2025-12-24 19:27 UTC
Last updated
2026-07-28 01:46 UTC
Primary CWE
CWE-611
Improper Restriction of XML External Entity Reference
Vendor / Product
NovaRad Corporation / NovaPACS Diagnostics Viewer
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
NovaRad Corporation NovaPACS Diagnostics Viewer — 8.5.19.75
Weakness (CWE)
CWESourceDescription
CWE-611 cna Improper Restriction of XML External Entity Reference
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.1 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References (3)
Back to overview