The vulnerability arises from improper neutralization of user‑supplied data. A remote unauthenticated attacker can create a malicious URL that includes JavaScript or HTML payloads. When a victim visits the URL, the code runs in the victim’s browser, enabling the attacker to steal session cookies and perform actions on behalf of the victim within the application.

The affected systems are CGM CLININET installations. Versions up to 2026.MS3 are confirmed vulnerable, and later releases might also be affected. The product is managed by CGM and is the only service noted to be impacted.

The CVSS score of 5.1 indicates moderate severity. No EPSS data and the vulnerability is not listed in CISA KEV, suggesting a low to moderate exploitation likelihood. An attacker only needs to send a crafted link—no authentication required—to achieve session compromise or unauthorized actions based on client‑side script execution.