INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities. CVE-2026-16305 allows a local low-privileged attacker to execute arbitrary commands with administrative privileges due to insecure file permissions on an update manifest file. CVE-2026-16306 allows remote code execution via a crafted imodular:// URI scheme that executes unsafe commands without proper validation. Both vulnerabilities have been fixed in versions 3.0.12.3 and 3.0.12.5.