CVE-2025-10767

A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.2. The affected element is the function connect/remote_upload/remote_download of the file main.py of the component Configuration File Handler. The manipulation of the argument configuration["PASSWORD"] results in os command injection. The attack requires a local approach. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-77
• CWE-78

• https://docs.google.com/document/d/1oq9YO831FbEDBI2BqNiW-7YA_kMzHJmMgy82F8f-L9g/edit?usp=sharing
• https://vuldb.com/?ctiid.325123
• https://vuldb.com/?id.325123
• https://vuldb.com/?submit.648118
• https://docs.google.com/document/d/1oq9YO831FbEDBI2BqNiW-7YA_kMzHJmMgy82F8f-L9g/edit?tab=t.0

Published

Sep 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10761A vulnerability has been found in Harness 3.3.0. Affected is…3.7
• CVE-2025-10762A vulnerability was found in kuaifan DooTask up to 1.2.49. A…6.3
• CVE-2025-10763A vulnerability was determined in academico-sis academico up…6.3
• CVE-2025-10764A vulnerability was identified in SeriaWei ZKEACMS up to 4.3…8.8
• CVE-2025-10765A security flaw has been discovered in SeriaWei ZKEACMS up t…7.2
• CVE-2025-10766A weakness has been identified in SeriaWei ZKEACMS up to 4.3…4.3
• CVE-2025-10768A flaw has been found in h2oai h2o-3 up to 3.46.08. The impa…9.8
• CVE-2025-10769A vulnerability has been found in h2oai h2o-3 up to 3.46.08.…9.8
• CVE-2025-1077A security vulnerability has been identified in the IBL Soft…9.5
• CVE-2025-10770A vulnerability was found in jeecgboot JimuReport up to 2.1.…6.5
• CVE-2025-10771A vulnerability was determined in jeecgboot JimuReport up to…9.8
• CVE-2025-10772A vulnerability was identified in huggingface LeRobot up to …6.3