CVE-2025-65270

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Dec 22, 2025

CISA due date

—

The record

Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.

Affected packages

Ecosystem	Package	Introduced	Fixed