Threat Intelligence Database

CVE-2025-57881 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyEmail functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The vulnerability impacts confidentiality and integrity by potentially allowing session hijacking, credential theft, or unauthorized actions within the application. The CVSS score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, but user interaction needed. No known exploits are currently reported in the wild.

MediumVulnerabilityGermanyFranceItaly+7#cve#cve-2025-57881#cwe-79

CVE-2025-53854 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyHL7Route functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited impact on confidentiality and integrity but no impact on availability. No known exploits are currently reported in the wild. European healthcare organizations using MedDream PACS Premium are at risk, as exploitation could lead to session hijacking, data theft, or phishing attacks within the medical imaging environment.

MediumVulnerabilityGermanyFranceItaly+4#cve#cve-2025-53854#cwe-79

CVE-2025-54853 is a reflected cross-site scripting (XSS) vulnerability in the modifyUser functionality of MedDream PACS Premium version 7.3.6.870. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction but no authentication, and it can lead to partial compromise of confidentiality and integrity through session hijacking or unauthorized actions. The vulnerability has a CVSS score of 6.1 (medium severity) and affects a critical healthcare imaging system used in medical environments. No known exploits are currently in the wild, and no patches have been published yet. European healthcare organizations using this specific version of MedDream PACS Premium should prioritize mitigation to prevent potential exploitation.

MediumVulnerabilityGermanyFranceItaly+4#cve#cve-2025-54853#cwe-79

CVE-2025-58093 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the config.php functionality affecting the phpdir parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) and does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. No known exploits are currently reported in the wild.

MediumVulnerabilityGermanyFranceItaly+5#cve#cve-2025-58093#cwe-79

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-36556#cwe-79