CVE-2025-54759

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Santesoft	Sante PACS Server	< 4.2.3

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Aug 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-54768.8Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to by CVE-2025-547604.8Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s we CVE-2025-547618.0An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie.CVE-2025-547629.3SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exe CVE-2025-547637.2FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the CVE-2025-547646.2Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gc CVE-2025-547655.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547665.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547676.5An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.CVE-2025-547685.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547698.8An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their CVE-2025-54777.5Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-a