CVE-2025-11138

HighCVSS 8.8/10Last modified Oct 9, 2026

Description

A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-111399.8A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.s CVE-2025-11145.4A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/sav CVE-2025-111409.8A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com CVE-2025-111414.7A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbo CVE-2025-111428.8The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can onl CVE-2025-111436.5The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs CVE-2025-111457.5Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthori CVE-2025-111465.4Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the CVE-2025-111475.4Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<fil CVE-2025-111489.8All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with CVE-2025-111497.5This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an e CVE-2025-11155.5A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_clos