CVE-2025-2264: high-severity vulnerability in Santesoft Sante PACS Server
Santesoft Sante PACS Server Path Traversal Information Disclosure
Published · Updated
70Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 35%
from disclosure to weapon0 days
Published on NVDMar 13
metasploitMar 13
VulnCheck+140d
exploitation probability
35%top 2% of all CVEs
observed exploitation
yesVulnCheck
A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Santesoft · Sante PACS ServerRelated CVEs — Santesoft Sante PACS Server
In the same product, most dangerous first.
CVE-2025-2284HIGHSantesoft Sante PACS Server Access of Uninitialized Pointer DoSEPSS 6.2%CVE-2025-2263CRITICALSantesoft Sante PACS Server Stack-based Buffer OverflowEPSS 0.9%CVE-2025-53948HIGHSantesoft Sante PACS Server Double FreeEPSS 0.8%CVE-2025-54156CRITICALSantesoft Sante PACS Server Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2025-54759MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%CVE-2025-54862MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%