Vulnerability · Published Nov 20, 2025 · Assigned by cisa-cg
CVE-2025-35029Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page
Low 3.5
In plain English
A low-severity cross-site scripting in Enterprise Health from Medical Informatics Engineering. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Medical Informatics Engineering | Enterprise Health | RC202503 – before RC202503 2025-04-08RC202409 – before RC202409 2025-04-08RC202403 – before RC202403 2025-04-08RC202309 – before RC202309 2025-04-08 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N