CVE-2025-35030

CVE-2025-35030 affects Medical Informatics Engineering Enterprise Health. The issue is a cross-site request forgery (CSRF) that allows an unauthenticated attacker to trick an administrator into performing actions on behalf of that administrator. The vulnerability is fixed as of 2025-04-08. Docume...

CVE-2025-35031

Medical Informatics Engineering Enterprise Health is affected by CVE-2025-35031, where the software includes the user’s current session token in debug output. This enables an attacker to impersonate the user if the token is exfiltrated (e.g., via the user sending debug output). The issue is fixed...

CVE-2025-35034

Medical Informatics Engineering Enterprise Health is affected by a reflected cross-site scripting vulnerability in the portlet_user_id URL parameter. A remote, unauthenticated attacker can craft a URL to execute arbitrary JavaScript in a victim’s browser. The issue is fixed as of 2025-03-14. Acco...

CVE-2025-35033

CVE-2025-35033 concerns Medical Informatics Engineering Enterprise Health. Affected: the platform's CSV export/download feature allowing a remote, authenticated attacker to inject macros into downloadable CSV files (CSV injection). Root cause details are not expanded in the provided documents bey...

CVE-2025-35032

CVE-2025-35032 — Medical Informatics Engineering Enterprise Health has a vulnerability where authenticated users can upload arbitrary files. The impact depends on how those files are subsequently accessed, per Red Hat and related advisories. The issue is reported as fixed as of 2025-04-08. Linked...

CVE-2025-35029

CVE-2025-35029 affects Medical Informatics Engineering Enterprise Health with a stored cross-site scripting vulnerability on the Demographic Information page. An authenticated attacker can inject arbitrary content that is rendered and executed when a victim accesses it. The issue is fixed as of 2...