CVE-2025-9223

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Sep 26, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-92255.5Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution CVE-2025-92264.6Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulner CVE-2025-92276.5Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.CVE-2025-92284.3MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege user CVE-2025-92295.3Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detai CVE-2025-92307.5Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and CVE-2025-92316.5Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementa CVE-2025-92325.9Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment va CVE-2025-92335.4A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manip CVE-2025-92345.4A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. Th CVE-2025-92355.4A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipul CVE-2025-92368.8A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario