CVE-2025-10350

Severity CVSS v4.0:

HIGH

Type:

CWE-89 SQL Injection

Publication date:

02/03/2026

Last modified:

02/03/2026

Description

SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0.

Impact

Vector 4.0

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L CVSS v4.0 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): Low
User Interaction (UI): None
Confidentiality (VC): High
Integrity (VI): High
Availability (VA): Low
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): Low

Base Score 4.0

8.80

Severity 4.0

HIGH

CVE-2025-10350

Description

Impact

References to Advisories, Solutions, and Tools