CVE-2025-24936

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet.

An attacker with low privileged access to the application has the potential to execute commands on the operating system under the context of the webserver.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-249379.0File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading t CVE-2025-249388.4The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high pri CVE-2025-24949.8Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server v CVE-2025-249465.3The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a conside CVE-2025-249475.3A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote atta CVE-2025-249486.5In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.CVE-2025-249496.5In JotUrl 2.0, is possible to bypass security requirements during the password change process.CVE-2025-24955.4Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the CVE-2025-249569.8A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsi CVE-2025-249579.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_soc CVE-2025-249588.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` CVE-2025-249591.0zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variabl