GCVE - cpe:2.3:a:openclinica:community_edition:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openclinica:community_edition:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Openclinica (`bd98c364-276b-571e-9b95-d5d9158ac702`)
Product	Community Edition (`1bbc545a-4ed7-5164-af45-135c54154a47`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-12922`	vulnerable	2026-06-08 07:04:31.206350	OpenClinica Community Edition CRF Data Import ImportCRFData path traversal MEDIUM (6.3) A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-11-10T00:02:06.090Z Updated: 2025-11-14T19:21:44.139Z Open on db.gcve.eu Reference links https://vuldb.com/?id.331642 https://vuldb.com/?ctiid.331642 https://vuldb.com/?submit.680873 https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12921`	vulnerable	2026-06-08 07:04:31.203835	OpenClinica Community Edition CRF Data Import ImportCRFData xml injection MEDIUM (4.3) A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads to xml injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-11-09T23:32:05.470Z Updated: 2025-11-14T17:43:12.721Z Open on db.gcve.eu Reference links https://vuldb.com/?id.331641 https://vuldb.com/?ctiid.331641 https://vuldb.com/?submit.680872 https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md#poc	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.