Skip to content
OpenAdvisories
High VA-25-272-01 6 CVEs

Medical Informatics Engineering Enterprise Health multiple vulnerabilities

Published Sep 29, 2025 · Updated Sep 29, 2025

Vendor: Medical Informatics Engineering Product: Enterprise Health

Summary

Medical Informatics Engineering Enterprise Health is an OEHR (Occupational Electronic Health Record) platform. Enterprise Health contains multiple vulnerabilities that could allow an attacker to inject executable content, obtain session tokens, and upload arbitrary files.

Vulnerabilities 6

  • High 8.1
    CVE-2025-35030

    Medical Informatics Engineering Enterprise Health cross site request forgery

    Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This …

    Medical Informatics Engineering Enterprise Health
  • Medium 4.3
    CVE-2025-35034

    Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id

    Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This…

    Medical Informatics Engineering Enterprise Health
  • Medium 4.1
    CVE-2025-35033

    Medical Informatics Engineering Enterprise Health CSV injection

    Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

    Medical Informatics Engineering Enterprise Health
  • Low 3.5
    CVE-2025-35029

    Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page

    Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim ac…

    Medical Informatics Engineering Enterprise Health
  • Low 3.4
    CVE-2025-35032

    Medical Informatics Engineering Enterprise Health arbitrary file upload

    Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.

    Medical Informatics Engineering Enterprise Health
  • Low 3.3
    CVE-2025-35031

    Medical Informatics Engineering Enterprise Health includes session token in debug output

    Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of …

    Medical Informatics Engineering Enterprise Health

Revision history

  1. #1.0.0

    Initial publication