CVE-2025-2265 Santesoft Sante PACS Server HTTP.db SHA1 Hash Truncation

The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte...

CVE-2025-2265: Use of Password Hash With Insufficient Computational Effort

The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte...

PT-2025-11208

Name of the Vulnerable Software and Affected Versions: Sante PACS Server.exe affected versions not specified Description: The issue concerns the storage of web user passwords in the Sante PACS Server.exe. Passwords are zero-padded to 0x2000 bytes, then SHA1-hashed and base64-encoded before being...