CVE-2025-57282

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 18, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-572837.8The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not proCVE-2025-572859.8codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatCVE-2025-57297.5A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected iCVE-2025-572926.1Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properCVE-2025-572938.8A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function iCVE-2025-572958.0H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user aCVE-2025-572966.5Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to thCVE-2025-57304.3The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege uCVE-2025-573056.5VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.CVE-2025-57315.5A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and incCVE-2025-573108.8A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 alloCVE-2025-573177.5apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the prePr
CVE-2025-57282: High severity, CVSS 8.8 | Vulnix