CVE-2025-63334

CRITICAL

PocketVJ-CP 3.9.1 submit_opacity.php - Root Command Injection

Title source: manual
STIX 2.1

Description

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0103
EPSS Percentile 59.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
magdesign/pocketvj_control_panel_firmware 3.9.1
Published Nov 05, 2025
Tracked Since Feb 18, 2026