CVE-2025-11142

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-111436.5The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs CVE-2025-111457.5Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an UnauthoriCVE-2025-111465.4Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in theCVE-2025-111475.4Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filCVE-2025-111489.8All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted withCVE-2025-111497.5This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an eCVE-2025-11155.5A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_closCVE-2025-111518.2Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulneCVE-2025-111528.6Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.0.3.CVE-2025-111537.5JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.CVE-2025-111545.4The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unautheCVE-2025-111556.8The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a stro