{"id":"CVE-2025-36846","aliases":["EUVD-2025-22140","GHSA-q9g9-363h-fq62"],"status":"published","title":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal...","description":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.04852,"percentile":0.92099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-07-21T00:00:00Z","modified":"2026-06-17T09:14:55Z","products":[{"vendor":"eveo","product":"urve_web_manager"}],"references":[{"url":"https://smartoffice.expert/en/","tags":["Product"]},{"url":"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-034.txt","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36846"},{"url":"https://smartoffice.expert/en"},{"url":"https://github.com/advisories/GHSA-q9g9-363h-fq62"}],"sources":{"cve":[{"id":"CVE-2025-36846","description":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.","status":"published","published":"2025-07-21T00:00:00Z","modified":"2025-07-21T19:05:38.118Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-22140","description":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.","status":"published","published":"2025-07-21T00:00:00Z","modified":"2025-07-21T19:05:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:06.121511Z"}],"ghsa":[{"id":"GHSA-q9g9-363h-fq62","title":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal...","description":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.","status":"published","published":"2025-07-21T18:32:18Z","modified":"2025-07-21T21:32:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:03:05.119098Z"}],"nvd":[{"id":"CVE-2025-36846","description":"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.","status":"published","published":"2025-07-21T18:15:27.587Z","modified":"2026-06-17T09:14:55.35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:19.382856Z"}]}}