CVE-2025-57791

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
Commvault	CommCell	>= 11.32.0, <= 11.32.101; >= 11.36.0, <= 11.36.59

References

https://documentation.commvault.com/securityadvisories/CV_2025_08_1.htmlVendor Advisory

Timeline

Published: Aug 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-5779210.0Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web appl CVE-2025-577938.6Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a CVE-2025-577949.1Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. Th CVE-2025-577959.9Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default CVE-2025-577966.8Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, includi CVE-2025-577978.5Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is explo CVE-2025-577985.5Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain CVE-2025-577998.7StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an a CVE-2025-57807.5A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2025-578008.8Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict CVE-2025-578019.1gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value CVE-2025-578028.7Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an