CVE-2019-12725

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txtExploit, Third Party Advisory
https://zeroshell.org/blog/Vendor Advisory
http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txtExploit, Third Party Advisory
https://zeroshell.org/blog/Vendor Advisory

Timeline

Published: Jul 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-127277.5On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The iss CVE-2019-127288.1Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over CVE-2019-12735.4A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error CVE-2019-127309.8aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows CVE-2019-127317.8The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to esca CVE-2019-127324.7The Chartkick gem through 3.1.0 for Ruby allows XSS.CVE-2019-127338.8SiteVision 4 allows Remote Code Execution.CVE-2019-127348.8SiteVision 4 has Incorrect Access Control.CVE-2019-127358.6getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command i CVE-2019-127369.8JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injec CVE-2019-127375.3UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.CVE-2019-127398.8lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacte