CVE-2018-25142

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

CVSS v4.0

7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-12-24

Updated

2026-07-28

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/45337

References

• CVE Record
• NVD entry

Related

• CVE-2018-25141
• CVE-2018-25143
• CVE-2018-25140
• CVE-2018-25144
• CVE-2018-25139
• CVE-2018-25145