CVE Intelligence

MedDream vulnerabilities

🔔 Create alert RSS

Published CVEs affecting MedDream products: 31 record(s), with severity, exploitation and fixes.

Pacs Server 30MedDream PACS Premium 29PACS Server Premium 1

Exploited only (KEV) →

CVE-2018-25372 High · 8.2 CWE-89 May 25, 2026
MedDream PACS Server Premium 6.7.1.1 SQL Injection via email
MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database.
CVE-2020-37009 High · 8.8 CWE-434 Jan 29, 2026
MedDream PACS Server 6.8.3.751 - Remote Code Execution
MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the uploadImage.php endpoint by authenticating and uploading a PHP shell to execute arbitrary system commands with elevated privileges.
CVE-2025-58095 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the imagedir parameter.
CVE-2025-58094 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the worklistsrc parameter.
CVE-2025-58093 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the phpdir parameter.
CVE-2025-58092 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the phpexe parameter.
CVE-2025-58091 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the thumbnaildir parameter.
CVE-2025-58090 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the uploaddir parameter.
CVE-2025-58089 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the longtermdir parameter.
CVE-2025-58088 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the archivedir parameter.
CVE-2025-58087 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the status parameter.
CVE-2025-58080 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-57881 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-57787 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-57786 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-55071 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54861 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54853 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54852 Medium · 6.1 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54817 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a URL to a malicious website to trigger this vulnerability.
CVE-2025-54814 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54778 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54495 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-54157 Medium · 5.4 CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in MedDream Pacs Server
A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVE-2025-53912 High · 8.1 CWE-73 Jan 20, 2026
An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of…
An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file read. An attacker can send http request to trigger this vulnerability.