CVE-2025-63749

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-63755.5A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStreaCVE-2025-637577.5Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.CVE-2025-63767.8A remote code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE file can force Arena Simulation to write beyCVE-2025-63777.8A remote code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE file can force Arena Simulation to write beyCVE-2025-63786.4The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shorCVE-2025-637837.6A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) oCVE-2025-637846.5An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook CVE-2025-637856.1A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerabilCVE-2025-63798.8The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the CVE-2025-63809.8The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpCVE-2025-638007.5The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missingCVE-2025-638079.8An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak
CVE-2025-63749: Medium severity, CVSS 6.5 | Vulnix