CVE-2025-67888
Last modified
CVE-2025-67888 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. EPSS estimates a 1.19% chance of exploitation in the next 30 days.
Description
An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2025-67888?
How severe is CVE-2025-67888?
How do I fix CVE-2025-67888?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-67875ChurchCRM is an open-source church management system. A priv…5.4
- CVE-2025-67876ChurchCRM is an open-source church management system. A stor…5.4
- CVE-2025-67877ChurchCRM is an open-source church management system. Versio…8.8
- CVE-2025-6788A CWE-668: Exposure of Resource to Wrong Sphere vulnerabilit…5.3
- CVE-2025-67886Bitrix24 through 25.100.300 allows Remote Code Execution bec…6.3
- CVE-2025-678871C-Bitrix through 25.100.500 allows Remote Code Execution be…9.8
- CVE-2025-67895Edge3 Worker RPC RCE on Airflow 2. This issue affects Apach…9.8
- CVE-2025-67896Exim before 4.99.1, with certain non-default rate-limit conf…9.8
- CVE-2025-67897In Sequoia before 2.1.0, aes_key_unwrap panics if passed a c…5.3
- CVE-2025-67898MJML through 4.18.0 allows mj-include directory traversal to…4.5
- CVE-2025-67899uriparser through 0.9.9 allows unbounded recursion and stack…2.9
- CVE-2025-6790The Quiz and Survey Master (QSM) WordPress plugin before 10…4.3
Are you affected by CVE-2025-67888?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST