CVE-2025-12922

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.mdThird Party Advisory
• https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridgedThird Party Advisory
• https://vuldb.com/?ctiid.331642Permissions Required, VDB Entry
• https://vuldb.com/?id.331642Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.680873Third Party Advisory, VDB Entry
• https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.mdThird Party Advisory
• https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridgedThird Party Advisory

Published

Nov 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12917A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04…4.3
• CVE-2025-12918A security flaw has been discovered in yungifez Skuul School…5.3
• CVE-2025-12919A vulnerability was detected in EverShop up to 2.0.1. Affect…3.7
• CVE-2025-1292Out-Of-Bounds Write in TPM2 Reference Library in Google Chro…6.7
• CVE-2025-12920A flaw has been found in qianfox FoxCMS up to 1.2.16. Affect…4.8
• CVE-2025-12921A vulnerability has been found in OpenClinica Community Edit…8.8
• CVE-2025-12923A vulnerability was determined in liweiyi ChestnutCMS up to …4.9
• CVE-2025-12924A vulnerability was identified in rymcu forest up to de53ce7…6.5
• CVE-2025-12925A security flaw has been discovered in rymcu forest up to de…9.8
• CVE-2025-12926A weakness has been identified in SourceCodester Farm Manage…8.8
• CVE-2025-12927A security vulnerability has been detected in DedeBIZ up to …7.2
• CVE-2025-12928A vulnerability was detected in code-projects Online Job Sea…9.8