« Volver al listado

CVE-2025-58090

Estado: AnalizadaMedia (6.1)—

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the uploaddir parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Meddream — Pacs Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58090",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58090",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-21T16:27:35.199146Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "MedDream",
          "product": "MedDream PACS Premium",
          "versions": [
            {
              "status": "affected",
              "version": "7.3.6.870"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-20T15:17:04.587",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2271",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the uploaddir parameter."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de cross-site scripting (XSS) reflejado existen en la funcionalidad config.php de MedDream PACS Premium 7.3.6.870. URLs maliciosas especialmente diseñadas pueden llevar a la ejecución de código JavaScript arbitrario. Un atacante puede proporcionar una URL diseñada para activar estas vulnerabilidades. Esta vulnerabilidad afecta al parámetro uploaddir."
    }
  ],
  "lastModified": "2026-06-17T09:43:54.460",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:meddream:pacs_server:7.3.6.870:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F239E49-18E8-4DE0-B9B8-C220C3BC0C62"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}