CVE-2025-57786

A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - talos-cna@cisco.com

Published

2026-01-20

Last modified

2026-01-21

Weaknesses

CWE-79

Affected products

• Meddream Pacs Premium (Meddream)
• Pacs Server (Meddream)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2269
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2269