CVE-2025-58093 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the config.php functionality affecting the phpdir parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) and does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. No known exploits are currently reported in the wild.
CVE-2025-58092 is a medium-severity reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870. The vulnerability exists in the config.php functionality, specifically affecting the 'phpexe' parameter, allowing attackers to craft malicious URLs that execute arbitrary JavaScript in the context of the victim's browser. Exploitation requires user interaction, such as clicking a malicious link, and no authentication is needed. This vulnerability can lead to partial compromise of confidentiality and integrity by stealing session tokens or manipulating web content. There are no known exploits in the wild, and no official patches have been published yet. European healthcare organizations using this PACS software are at risk, especially in countries with significant healthcare infrastructure relying on MedDream PACS.
CVE-2025-58091 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically affecting the 'thumbnaildir' parameter in the config.php functionality. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but no authentication, and it can lead to partial compromise of confidentiality and integrity through session hijacking or data manipulation. The vulnerability has a CVSS score of 6.1 (medium severity) and no known exploits in the wild as of now. European healthcare organizations using this PACS software are at risk, especially those with public-facing web interfaces.
CVE-2025-58090 is a medium severity reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the config.php functionality affecting the 'uploaddir' parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The impact includes potential theft of session tokens, user impersonation, or redirection to malicious sites. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk, especially those with direct internet access to the vulnerable interface.
CVE-2025-58089 is a medium-severity reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the config.php functionality affecting the longtermdir parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim's browser. This vulnerability requires no authentication but does require user interaction (clicking the malicious link). The vulnerability impacts confidentiality and integrity by potentially stealing session tokens or manipulating web content, but does not affect availability. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk, especially in countries with significant healthcare IT infrastructure.
CVE-2025-58088 is a medium severity reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the config.php functionality affecting the 'archivedir' parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim’s browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The vulnerability impacts confidentiality and integrity by potentially stealing session tokens or manipulating web content. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk, especially in countries with significant deployments of MedDream PACS.
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the status parameter.
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file read. An attacker can send http request to trigger this vulnerability.
An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840.
A specially crafted application can decrypt credentials stored in a configuration-related registry key.
An attacker can execute a malicious script or application to exploit this vulnerability.
A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead to elevated capabilities. An attacker can upload a malicious file to trigger this vulnerability.
A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.