CVE-2025-65270

MEDIUM

Clincapture Captivate Electronic Data Capture - XSS

Title source: rule

Description

Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.

Exploits (1)

nomisec WORKING POC

by xh4vm · poc

https://github.com/xh4vm/CVE-2025-65270

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://github.com/xh4vm/CVE-2025-65270

[Product] https://www.clincapture.com/

Scores

CVSS v3 6.1

EPSS 0.0011

EPSS Percentile 29.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

clincapture/captivate_electronic_data_capture 2.2.3

clincapture/captivate_electronic_data_capture 3.0

Published Dec 22, 2025

Tracked Since Feb 18, 2026