OpenClinic GA version 5.351.19 has a reflected cross‑site scripting flaw in the DICOM image upload handler. Injected JavaScript placed in DICOM metadata fields such as Study Description is reflected without sanitization into popup.jsp and archiving/uploadfiles_jsp.java. This allows the attacker to run arbitrary JavaScript in the browser of a user who views the affected pages, resulting in client‑side code execution.

The vulnerability affects OpenClinic GA from vendor frankverbeke, with the specific affected release being 5.351.19. No additional affected versions are listed in the CVE data.

The CVSS score is 5.3, denoting medium severity. EPSS information is not available and the flaw is not listed in CISA's KEV catalog, indicating it has not been widely exploited publicly. Exploitation requires a crafted DICOM file to be submitted to the upload handler, after which the malicious payload is reflected directly into a victim's browser when they access the JSP pages that display the metadata. The impact is limited to the client’s browser environment and does not affect the server or network directly.