CVE-2025-2263: Stack-based Buffer Overflow

During login to the web server in "Sante PACS Server.exe", OpenSSL function EVPDecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte stack-based buffer is passed to the function as the output buffer. A stack-based buffer overflow exists if a long encrypted username or...

PT-2025-11206 · Unknown +1 · Sante Pacs Server.Exe +1

Name of the Vulnerable Software and Affected Versions: Sante PACS Server affected versions not specified Description: The issue is related to a stack-based buffer overflow in the OpenSSL function EVP DecryptUpdate, which is called during login to the web server in Sante PACS Server.exe. This...

PT-2025-11209

Name of the Vulnerable Software and Affected Versions: Sante PACS Server.exe affected versions not specified Description: A denial-of-service issue exists in the GetWebLoginCredentials function. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

CVE-2025-2265: Use of Password Hash With Insufficient Computational Effort

The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte...

PT-2025-11208

Name of the Vulnerable Software and Affected Versions: Sante PACS Server.exe affected versions not specified Description: The issue concerns the storage of web user passwords in the Sante PACS Server.exe. Passwords are zero-padded to 0x2000 bytes, then SHA1-hashed and base64-encoded before being...

Santesoft Sante PACS Server 安全漏洞

Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. Used to store, archive, manage, view and burn medical images. A security vulnerability exists in Santesoft San...

Sante PACS Server Path Traversal (CVE-2025-2264)

This module exploits a path traversal vulnerability CVE-2025-2264 in Sante PACS Server use auxiliary/gather/pacsserver/traversal msf undefinedtraversal show actions ...actions... msf undefinedtraversal set ACTION msf undefinedtraversal show options ...show and set options... msf undefinedtraversa...

CVE-2025-1085

A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-1085

A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-1085 Animati PACS login cross site scripting

A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-1085

CVE-2025-1085 affects Animati PACS up to 1.24.12.09.03. The issue stems from manipulating the argument p in the /login endpoint, which leads to cross-site scripting. It is possible to initiate the attack remotely, and public exploit disclosure is noted; vendor has not publicly responded to disclo...

CVE-2025-1085 Animati PACS login cross site scripting

A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to...

PT-2025-5897

Name of the Vulnerable Software and Affected Versions Animati PACS versions up to 1.24.12.09.03 Description A problematic issue was found in Animati PACS, affecting an unknown part of the file /login. The manipulation of the p argument leads to cross-site scripting. It is possible to initiate the...

Animati PACS 代码注入漏洞

Animati PACS is a powerful and stable PACS system from Animati. A code injection vulnerability exists in Animati PACS version 1.24.12.09.03 and earlier, which stems from improper handling of the /login file parameter and could lead to a cross-site scripting attack...

CVE-2025-1085: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2022-2272

This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the login endpoint. When parsing the username element,...

CVE-2025-0573

Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-0574

Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-0572

Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw...

CVE-2025-0573

Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...