PT-2025-53362 · Undefined · Undefined

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25142

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-25142

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25142 · Security Note
• https://exploit-db.com/exploits/45337 · Note
• https://novarad.net · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php · Note