Vulnerability · Published Jun 9, 2026 · Assigned by VulnCheck

CVE-2026-25860OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler

Medium 6.1

In plain English

A medium-severity cross-site scripting in OpenClinic GA from frankverbeke. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.

Affected products (as reported)

Vendor	Product	Versions
frankverbeke	OpenClinic GA	0 – through 5.351.19

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce technical-description, exploit
https://github.com/partywavesec/CVE-2026-25860 technical-description, exploit
https://www.vulncheck.com/advisories/openclinic-ga-reflected-xss-via-dicom-image-upload-handler third-party-advisory