CVE-2018-25372
MedDream PACS Server Premium 6.7.1.1 SQL Injection via email
CVSS Score
8.2
EPSS Score
0.1%
EPSS Percentile
19th
MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database.
| CWE | CWE-89 |
| Vendor | meddream |
| Product | pacs server premium |
| Published | May 25, 2026 |
| Last Updated | May 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for meddream pacs server premium
Be the first to know when new high vulnerabilities affecting meddream pacs server premium are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
MedDream / PACS Server Premium
6.7.1.1
References
Credits
Carlos Avila