CVE-2025-24861

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker may inject commands via specially-crafted post requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-248622.0Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User ApplicCVE-2025-248636.5Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow aCVE-2025-248647.8Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerabCVE-2025-248659.8The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attackCVE-2025-248662.7Mattermost versions 9.11.x <= 9.11.8  fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated gCVE-2025-248676.1SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. CVE-2025-248687.1The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) alCVE-2025-248694.3SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server componentCVE-2025-24874.9A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when tCVE-2025-248706.0SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to acCVE-2025-248724.3The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By exeCVE-2025-248746.8SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effectiv
CVE-2025-24861: Critical severity, CVSS 9.8 | Vulnix