CVE-2025-15133

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
ZSPACE	Z4Pro+	1.0.0440024

References

https://github.com/LX-66-LX/cve/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.338511Permissions Required, VDB Entry
https://vuldb.com/?id.338511Third Party Advisory, VDB Entry
https://vuldb.com/?submit.713887Third Party Advisory, VDB Entry

Timeline

Published: Dec 28, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-151343.5A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainCon CVE-2025-151356.3A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of t CVE-2025-151368.8A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wiza CVE-2025-151378.8A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWith CVE-2025-151387.2A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfileman CVE-2025-151398.8A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Su CVE-2025-15147.3The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calli CVE-2025-151407.3A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown c CVE-2025-151413.1A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Conf CVE-2025-151427.3A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file s CVE-2025-151437.2A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic CVE-2025-151446.1A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /