CVE-2025-36846

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.

• CWE-78

• https://smartoffice.expert/en/Product
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-034.txtExploit, Third Party Advisory

Published

Jul 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3680A vulnerability has been found in PCMan FTP Server 2.0.7 and…9.8
• CVE-2025-3681A vulnerability was found in PCMan FTP Server 2.0.7 and clas…9.8
• CVE-2025-3682A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-3683A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-3684A vulnerability was found in Xianqi Kindergarten Management …9.8
• CVE-2025-36845An issue was discovered in Eveo URVE Web Manager 27.02.2025.…8.6
• CVE-2025-3685A vulnerability classified as critical has been found in cod…8.8
• CVE-2025-36852A critical security vulnerability exists in remote cache ext…9.4
• CVE-2025-36853A vulnerability (CVE-2025-21172) exists in msdia140.dll due …7.5
• CVE-2025-36854A vulnerability ( CVE-2024-38229 https://www.cve.org/CVEReco…8.1
• CVE-2025-36855A vulnerability ( CVE-2025-21176 https://www.cve.org/CVEReco…8.8
• CVE-2025-36857Rapid7 Appspider Pro versions below 7.5.021, suffer from a b…3.3