CVE-2025-57786

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
MedDream	MedDream PACS Premium	7.3.6.870

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2269Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2269Exploit, Third Party Advisory

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577876.1A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially CVE-2025-577886.5A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC he CVE-2025-577895.4During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain CVE-2025-57797.5A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerabil CVE-2025-577908.8A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversa CVE-2025-577916.5A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal CVE-2025-5779210.0Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web appl CVE-2025-577938.6Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a CVE-2025-577949.1Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. Th CVE-2025-577959.9Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default CVE-2025-577966.8Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, includi CVE-2025-577978.5Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is explo