PT-2026-3591

CVE-2025-36556

Published

2026-01-20

Updated

2026-01-20

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MedDream PACS Premium version 7.3.6.870

Description A reflected cross-site scripting (xss) issue exists within the ldapUser functionality. A malicious URL, specifically crafted, can result in the execution of arbitrary javascript code. An attacker can trigger this by providing a crafted URL. The ldapUser functionality is susceptible to this attack.

Recommendations Apply updates to address the issue in the ldapUser functionality.

Exploitability

Exploit

Fix

Impacts

Researchers

Marcin Icewall

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers