Openclinica is a clinical trial data management platform with a compact vulnerability footprint concentrated in its core product. The observed weakness classes—path traversal, injection variants including SQL and XML injection, and output neutralization issues—reflect the input-handling and data-processing demands of web-based research applications. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openclinica over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-24831CRITICAL OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use | May 14, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-24830CRITICAL OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in mu | May 14, 2022 | 9.8 | 31 | NO | NO |
CVE-2025-12922HIGH A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Impor | Nov 10, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-12921HIGH A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of | Nov 10, 2025 | 8.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openclinica.
Media articles that mention a CVE ID that affects a product developed by Openclinica — matched by CVE ID, not by vendor name.