CVE-2025-4866

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component Management Console. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
weibocom	rill-flow	0.1.18

References

https://github.com/weibocom/rill-flow/issues/102Exploit, Issue Tracking
https://github.com/weibocom/rill-flow/issues/102#issue-2933822293Exploit
https://vuldb.com/?ctiid.309408Permissions Required, VDB Entry
https://vuldb.com/?id.309408Third Party Advisory, VDB Entry
https://vuldb.com/?submit.575478Exploit, Third Party Advisory, VDB Entry
https://github.com/weibocom/rill-flow/issues/102Exploit, Issue Tracking

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Undergoing Analysis

Related CVEs from 2025

CVE-2025-48676.5A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function form CVE-2025-48686.3A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critica CVE-2025-48699.8A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the CVE-2025-486956.4An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their priv CVE-2025-48709.8A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. This vulnerability affects unknown code o CVE-2025-487006.1An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zi CVE-2025-487015.4openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.CVE-2025-487039.0CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in t CVE-2025-487047.5Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort CVE-2025-487057.5An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message for CVE-2025-487069.1An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces t CVE-2025-487077.5An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be s