CVE-2025-10327

MEDIUM

sourcefabric rpi-jukebox-rfid < 2.8.0 - OS Command Injection via Playlist Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-10327. PoCs published by Beatriz Fresno Naumova.

AI-analyzed exploit summary This PoC demonstrates an OS command injection vulnerability in RPi-Jukebox-RFID 2.8.0 via the shuffle.php API endpoint. The 'playlist' parameter is injected with arbitrary commands, leading to remote code execution.

Description

A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

exploitdb WORKING POC
by Beatriz Fresno Naumova · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52468

This PoC demonstrates an OS command injection vulnerability in RPi-Jukebox-RFID 2.8.0 via the shuffle.php API endpoint. The 'playlist' parameter is injected with arbitrary commands, leading to remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: RPi-Jukebox-RFID v2.8.0
No auth needed
Prerequisites: Network access to the target's API endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/52468
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.323753
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.323753
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.643511

Scores

CVSS v3 6.3
EPSS 0.1016
EPSS Percentile 95.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
sourcefabric/rpi-jukebox-rfid < 2.8.0
Published Sep 12, 2025
Tracked Since Feb 18, 2026