CVE-2025-53707

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-537095.4Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only install CVE-2025-53719.8A vulnerability, which was classified as critical, has been found in SourceCodester Health Center Patient Record Management System 1.0. Affe CVE-2025-537107.5Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with CVE-2025-537117.5A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetwor CVE-2025-537127.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing CVE-2025-537137.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing CVE-2025-537147.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to mi CVE-2025-537157.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missin CVE-2025-537166.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a CVE-2025-537177.0Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to CVE-2025-537187.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-537195.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over