CVE-2025-8858: Changing Clinic Image System

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

Affected products

• Changing Clinic Image System: up to and including 2.4.23.2131; from 1.5, before 1.6 (fixed in 1.6); from 2.0, before 2.1 (fixed in 2.1)

Published 2025-08-29. Last modified 2026-06-17.