CVE-2025-10659

The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.

• CWE-78

• https://support.portal.megasys.com/
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01

Published

Sep 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10652The Robcore Netatmo plugin for WordPress is vulnerable to SQ…6.5
• CVE-2025-10653An unauthenticated debug port may allow access to the device…8.6
• CVE-2025-10655SQL Injection in Frappe HelpDesk in the dashboard get_dashbo…8.8
• CVE-2025-10656The Spreadsheet Price Changer for WooCommerce and WP E-comme…9.8
• CVE-2025-10657In a hardened Docker environment, with Enhanced Container Is…8.7
• CVE-2025-10658The SupportCandy – Helpdesk & Customer Support Ticket System…6.5
• CVE-2025-1066OpenPLC_V3 contains an arbitrary file upload vulnerability, …9.8
• CVE-2025-10660The WP Dashboard Chat plugin for WordPress is vulnerable to …6.5
• CVE-2025-10662A vulnerability has been found in SeaCMS up to 13.3. The imp…9.8
• CVE-2025-10663A vulnerability was found in PHPGurukul Online Course Regist…9.8
• CVE-2025-10664A vulnerability was determined in PHPGurukul Small CRM 4.0. …9.8
• CVE-2025-10665A vulnerability was identified in kidaze CourseSelectionSyst…9.8