CVE-2025-0396

exelban stats XPC Service shouldAcceptNewConnection command injection

8.5 High

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.98%Up 0.9 points since Jan 13, 2025

What each source reports

CVE List Score used 8.5

exelban stats XPC Service shouldAcceptNewConnection command injection

Record: CVE-2025-0396
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-77, CWE-74
Updated: 2026-11-02

EUVDEUVD-2025-1643 8.5

Record: EUVD-2025-1643
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-82p7-qmv8-9mwf 8.5

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21....

Record: GHSA-82p7-qmv8-9mwf
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

NVD 8.5

Record: CVE-2025-0396
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:L/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-74, CWE-77
Updated: 2026-11-02

OSV 8.5

exelban stats XPC Service shouldAcceptNewConnection command injection

Record: CVE-2025-0396
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-74, CWE-77
Updated: 2026-11-02

Affected products

exelban stats

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-0396 is a high vulnerability (CVSS 8.5) in Exelban Stats, published January 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. No source names a fixed version.