What is CVE-2018-25142?

CVE-2018-25142 is a critical-severity vulnerability in Novarad Corporation Novapacs Diagnostics Viewer, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2025-12-24.

How severe is CVE-2018-25142?

Critical severity. CVSS v3 base score is 9.8 out of 10.

XXE in Novarad Corporation Novapacs Diagnostics Viewer

CVE-2018-25142

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.004 (30.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Novarad Corporation Novapacs Diagnostics Viewer — versions 8.5.19.75

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

ExploitDB-45337 (exploit)
NovaRad Corporation Product Homepage (product)
Zero Science Lab Disclosure (ZSL-2018-5488) (third-party-advisory)

Frequently asked questions

What is CVE-2018-25142?: CVE-2018-25142 is a critical-severity vulnerability in Novarad Corporation Novapacs Diagnostics Viewer, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2025-12-24.
How severe is CVE-2018-25142?: Critical severity. CVSS v3 base score is 9.8 out of 10.