CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
CRITICAL 9.4EPSS 1.9%
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
- Affected
- devcode-it · openstamanager
- CVSS v4.0 GITHUB
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v4.0 GitHub
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.94% chance of exploitation in the next 30 days, 80th percentile
- Published
- 2026-02-06
- Updated
- 2026-02-09
Proof-of-concept exploits (11)
- lolw0/OpenSTA-Exploit0★ · 2026-08-25
- 0Zetrium0/CVE-2025-69212_PoC0★ · 2026-07-03
- BridgerAlderson/CVE-2025-69212-PoC5★ · 2026-07-02
- Pasindu-sd/CVE-2025-69212-Exploit0★ · 2026-08-21
- alaeddine03/CVE-2025-69212-PoC0★ · 2026-07-01
- c0gnit00/CVE-2026-692122★ · 2026-06-28
- liaomilk/CVE-2025-69212-for-myself0★ · 2026-08-18
- m2sousa/CVE-2025-692120★ · 2026-07-01
- tohib09/CVE-2025-69212-PoC4★ · 2026-06-28
- w3nch/CVE-2025-692121★ · 2026-06-29
- xorandd/CVE-2025-69212-PoC0★ · 2026-07-07