What’s Vulnerable › Vulnerabilities

CVE-2018-25372: MedDream PACS Server Premium 6.7.1.1 SQL Injection via email

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-25 · updated 2026-07-23
• Weakness: CWE-89

Description

MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database.

Affected products

• MedDream PACS Server Premium: 6.7.1.1

References

• https://www.exploit-db.com/exploits/45344
• https://www.vulncheck.com/advisories/meddream-pacs-server-premium-sql-injection-via-email

Get alerted when CVE-2018-25372 or the next vulnerability affects your stack