CVE-2025-12916

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Sangfor	Operation and Maintenance Security Management System	3.0

References

https://h4cker.zip/post/fe0ada/Exploit, Third Party Advisory
https://vuldb.com/?ctiid.331634Permissions Required, VDB Entry
https://vuldb.com/?id.331634Third Party Advisory, VDB Entry
https://vuldb.com/?submit.678377Third Party Advisory, VDB Entry
https://h4cker.zip/post/fe0ada/Exploit, Third Party Advisory

Timeline

Published: Nov 9, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-129174.3A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post CVE-2025-129185.3A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of t CVE-2025-129193.7A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order CVE-2025-12926.7Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access t CVE-2025-129204.8A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controll CVE-2025-129218.8A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of t CVE-2025-129228.8A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action CVE-2025-129234.9A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev CVE-2025-129246.5A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult CVE-2025-129259.8A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/g CVE-2025-129268.8A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review CVE-2025-129277.2A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_a