CVE-2025-3002

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The manipulation of the argument type_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-300226.8CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.CVE-2025-300239.0The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execu CVE-2025-300246.8The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.CVE-2025-300257.8The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio CVE-2025-300269.8The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.CVE-2025-300276.7An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only b CVE-2025-300288.6A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.CVE-2025-30036.3A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/User CVE-2025-300308.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300318.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300328.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300337.8The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user i