CVE-2025-54817 is a reflected cross-site scripting (XSS) vulnerability found in the autoPurge functionality of MedDream PACS Premium version 7.3.6.870. This vulnerability allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. The vulnerability requires user interaction, specifically clicking or visiting the malicious URL, and does not require authentication. The CVSS 3.1 base score is 6.1, indicating medium severity, with low impact on confidentiality and integrity but no impact on availability. No known exploits are currently reported in the wild.
CVE-2025-53516 is a reflected cross-site scripting (XSS) vulnerability found in the downloadZip functionality of MedDream PACS Premium version 7.3.6.870. This vulnerability allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. The vulnerability requires no authentication but does require user interaction to click or visit the malicious link. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. There are no known exploits in the wild, and no patches have been published yet. European healthcare organizations using this specific version of MedDream PACS Premium are at risk, especially those with less restrictive web access policies.
CVE-2025-54495 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the emailfailedjob functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code within the victim's browser context. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication, and it can impact confidentiality and integrity by stealing session tokens or manipulating displayed content. The CVSS score is 6.1 (medium severity), reflecting the moderate impact and ease of exploitation. No known exploits are currently in the wild, and no patches have been published yet. European healthcare organizations using MedDream PACS Premium are at risk, especially in countries with significant adoption of this medical imaging software.
CVE-2025-54157 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the encapsulatedDoc functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity) reflecting limited confidentiality and integrity impact without availability impact. No known exploits are currently reported in the wild. European healthcare organizations using MedDream PACS Premium should be aware of this risk as it could lead to session hijacking, phishing, or unauthorized actions within the PACS web interface.
CVE-2025-54778 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the existingUser functionality. This flaw allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. The vulnerability requires user interaction (clicking the malicious link) but does not require authentication, and it can lead to partial compromise of confidentiality and integrity of user sessions. Although no known exploits are currently reported in the wild, the medium severity CVSS score of 6.1 reflects the potential risk. European healthcare organizations using this PACS software should prioritize patching or applying mitigations to prevent exploitation. Countries with significant healthcare infrastructure and MedDream PACS deployments, such as Germany, France, and the UK, are likely to be most affected.
CVE-2025-46270 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the fetchPriorStudies functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1, indicating a medium severity with potential impacts on confidentiality and integrity but no direct availability impact. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk of targeted phishing or social engineering attacks leveraging this vulnerability.
CVE-2025-55071 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyAnonymize functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. There are no known exploits in the wild currently, and no patch has been released yet. European healthcare organizations using this PACS software are at risk of targeted attacks that could lead to session hijacking or data manipulation.
CVE-2025-54852 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyAeTitle functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. There are no known exploits in the wild currently, and no patches have been linked yet. European healthcare organizations using this PACS software could be targeted, potentially risking patient data confidentiality and session integrity.
CVE-2025-54814 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyAutopurgeFilter functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. No known exploits are currently reported in the wild. European healthcare organizations using MedDream PACS Premium are at risk, especially those with exposed web interfaces.
CVE-2025-54861 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the modifyCoercion functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), indicating moderate impact primarily on confidentiality and integrity, with no direct impact on availability. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk of targeted attacks that could lead to session hijacking, data theft, or further exploitation via the injected script.
CVE-2025-57881 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyEmail functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The vulnerability impacts confidentiality and integrity by potentially allowing session hijacking, credential theft, or unauthorized actions within the application. The CVSS score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, but user interaction needed. No known exploits are currently reported in the wild.
CVE-2025-58080 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyHL7App functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires no authentication but does require user interaction to click the malicious link. The CVSS score is 6.1 (medium severity), indicating a moderate risk with potential confidentiality and integrity impacts but no direct availability impact. No known exploits are currently in the wild. European healthcare organizations using this PACS software are at risk of targeted attacks that could lead to session hijacking or data manipulation.
CVE-2025-53854 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyHL7Route functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited impact on confidentiality and integrity but no impact on availability. No known exploits are currently reported in the wild. European healthcare organizations using MedDream PACS Premium are at risk, as exploitation could lead to session hijacking, data theft, or phishing attacks within the medical imaging environment.
CVE-2025-57787 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyRoute functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk of targeted phishing or social engineering attacks leveraging this vulnerability.
CVE-2025-53707 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the modifyTranscript functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting limited confidentiality and integrity impact but no availability impact. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk of targeted phishing or social engineering attacks leveraging this XSS flaw.
CVE-2025-54853 is a reflected cross-site scripting (XSS) vulnerability in the modifyUser functionality of MedDream PACS Premium version 7.3.6.870. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction but no authentication, and it can lead to partial compromise of confidentiality and integrity through session hijacking or unauthorized actions. The vulnerability has a CVSS score of 6.1 (medium severity) and affects a critical healthcare imaging system used in medical environments. No known exploits are currently in the wild, and no patches have been published yet. European healthcare organizations using this specific version of MedDream PACS Premium should prioritize mitigation to prevent potential exploitation.
CVE-2025-57786 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically in the notifynewstudy functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the context of the victim's browser. This vulnerability requires user interaction, such as clicking a malicious link, and does not require authentication. The CVSS score is 6.1 (medium severity) due to its potential to compromise confidentiality and integrity but not availability. No known exploits are currently reported in the wild. European healthcare organizations using this PACS software are at risk, particularly in countries with significant MedDream deployments.
CVE-2025-44000 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the sendOruReport functionality. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The CVSS score is 6.1 (medium severity), reflecting the potential for limited confidentiality and integrity impact without affecting availability. No known exploits are currently reported in the wild. European healthcare organizations using MedDream PACS Premium should be aware of this risk and apply mitigations promptly to prevent potential data leakage or session hijacking.
CVE-2025-58095 is a medium-severity reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, specifically affecting the imagedir parameter in the config.php functionality. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim’s browser. This vulnerability requires user interaction (clicking the malicious link) but no authentication, and it can impact confidentiality and integrity by stealing session tokens or manipulating displayed data. There are no known exploits in the wild yet. European healthcare organizations using MedDream PACS Premium are at risk, especially those with public-facing PACS web interfaces. Mitigation involves applying vendor patches when available, implementing strict input validation and output encoding on the imagedir parameter, and employing web application firewalls (WAFs) to detect and block malicious requests.
CVE-2025-58094 is a medium-severity reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870. The flaw exists in the config.php functionality, specifically affecting the 'worklistsrc' parameter. An attacker can craft malicious URLs that, when visited by a user, execute arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (clicking the malicious link) but does not require authentication. The vulnerability impacts confidentiality and integrity by potentially stealing session tokens or manipulating page content, but does not affect availability. No known exploits are currently reported in the wild.
