CVE-2025-13284

ThinPLUS｜ThinPLUS - OS Command Injection

CVSS 9.3 CRITICALEPSS 1.6%CWE-78

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.3EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

17 nov 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

ThinPLUS · ThinPLUS

Referencias

https://www.twcert.org.tw/en/cp-139-10513-0d82b-2.html https://www.twcert.org.tw/tw/cp-132-10512-e196b-1.html