A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
References
| Link | Resource |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2025-2258 | Exploit Third Party Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2258 | Exploit Third Party Advisory |
Configurations
History
29 Jan 2026, 15:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:meddream:pacs_server:7.3.6.870:*:*:*:premium:*:*:* | |
| First Time |
Meddream pacs Server
Meddream |
|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2025-2258 - Exploit, Third Party Advisory | |
| References | () https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2258 - Exploit, Third Party Advisory |
20 Jan 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 15:16
Updated : 2026-01-29 15:23
NVD link : CVE-2025-46270
Mitre link : CVE-2025-46270
CVE.ORG link : CVE-2025-46270
JSON object : View
Products Affected
meddream
- pacs_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')