CVE-2025-35033

MediumCVSS 4.1

Published: 29/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

Risk Assessment

Opening an infected CSV file by a user could lead to execution of malicious macros and potential compromise of the workstation.

Recommendation

Update Enterprise Health to the version containing the fix from 2025-03-14 and instruct users not to open untrusted CSV files with macros.

Other vulnerabilities in Medical Informatics Engineering Enterprise Health

CVE-2025-35030High
A Cross-Site Request Forgery (CSRF) vulnerability in Medical Informatics Engineering Enterprise Health allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on their behalf. The issue is fixed as of 2025-04-08.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS