A cross‑site scripting flaw exists in Orthanc Explorer 2 up to version 1.12.0, triggered by manipulating the remote‑source argument in the StudyList.vue component. Leveraging this vulnerability an attacker can inject malicious scripts that execute within the victim’s browser in the context of the application, potentially stealing session data, defacing the interface, or performing actions as the authenticated user. The attack can be launched remotely without any authentication.

Orthanc:Explorer 2 versions prior to and including 1.12.0 are affected. The flaw resides in the WebApplication/src/components/StudyList.vue file of the URL Handler component of this product.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. An exploit is publicly available, and because the vulnerable parameter is reachable via unmanaged web requests, the flaw can be abused from anywhere on the internet with no special pre‑conditions. The relative risk is moderate, but the potential for user credential theft or session hijacking makes the flaw a priority for remediation.