The Sante PACS Server web portal is vulnerable to stored cross-site scripting (XSS). This vulnerability allows an attacker to inject malicious HTML code, which can redirect users to a harmful webpage and potentially steal their cookies. Users must interact with the malicious content for the attack to succeed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-54862 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious payload that can be injected into the Sante PACS Server web portal. This typically involves tricking a user into clicking a link or visiting a page that contains the malicious code, which then executes in the context of the user’s session, allowing the attacker to steal cookies or perform other malicious actions.
Affected Products
- Sante PACS Server: A web portal used for managing medical images, which is susceptible to XSS attacks.
Mitigation
To mitigate this vulnerability, it is recommended to implement input validation and output encoding to prevent the injection of malicious scripts. Additionally, users should be educated about the risks of clicking on untrusted links and the importance of maintaining updated software.