CVE-2025-13284

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2025
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-132859.8A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php.CVE-2025-132868.8A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.CVE-2025-132878.8A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=catego CVE-2025-132888.8A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUser CVE-2025-132898.8A vulnerability was detected in 1000projects Design & Development of Student Database Management System 1.0. Affected is an unknown function CVE-2025-13297.8IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to fai CVE-2025-132908.8A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-132919.8A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.CVE-2025-132927.6A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs bel CVE-2025-132939.3A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-le CVE-2025-132949.3An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporat CVE-2025-132957.5Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This is