CVE-2025-36846

CRITICAL EPSS 90.7%

Published Jul 21, 202511mo ago · Modified Jun 17, 20261w ago

9.8 CVSS 3.1

Critical

Published Jul 21, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

90.7% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 1

Vendor	Product	Version	Range
eveo	urve_web_manager	27.02.2025	any

References 2

smartoffice.expert https://smartoffice.expert/en/

Product
syss.de https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-034.txt

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.