by Kastro
Paper/Archive/CVE-2025-13284

CVE-2025-13284

ThinPLUS ThinPLUS — ThinPLUS｜ThinPLUS - OS Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.7.777 × 2015.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Affected

ProductAffectedFixed inSource
ThinPLUSTPmCloud4.0–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10512-e196b-1.htmlwriteuptwcert.org.tw/en/cp-139-10513-0d82b-2.html