CVE Feed

    Dashboard / CVE / CVE-2018-25124

    CVE-2018-25124

    PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path' parameter. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

    Published:Nov 10, 2025
    Last Modified:Apr 15, 2026
    EPS:Nov 10, 2025
    EPSS Score:0.01389
    CVSS Score:8.7

    Affected Products

    Vendor
    Rainbowfishsoftware
    Product
    Pacsone Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-29166 (CVSS 7.5) — PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in…
    CVE-2020-29165 (CVSS 9.8) — PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result …
    CVE-2020-29164 (CVSS 6.1) — PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).…
    CVE-2020-29163 (CVSS 8.8) — PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.…
    CVE-2020-12869 (CVSS 5.4) — RainbowFish PacsOne Server 6.8.4 allows XSS.…
    CVE-2020-12715 (CVSS 8.8) — RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.…
    CVE-2020-12870 (CVSS 9.8) — RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High