CVE-2025-13444

MediumCVSS 6.8/10Last modified Aug 10, 2026

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Progress Software	LoadMaster	>= 7.2.50, < V7.2.62.2; >= 7.2.50, < V7.2.54.16
Progress Software	Multi Tenant LoadMaster	>= 7.2.39, < V7.1.35.15

References

Timeline

Published: Jan 13, 2026
Last modified: Aug 10, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-134459.8A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of CVE-2025-134469.8A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The man CVE-2025-134476.8OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administr CVE-2025-134486.4The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all ver CVE-2025-134499.8A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The m CVE-2025-134505.4A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. Th CVE-2025-134519.8A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.ph CVE-2025-134524.3The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all v CVE-2025-134534.6A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the CVE-2025-134545.5A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sen CVE-2025-134557.8A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device auth CVE-2025-134566.1The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a