ByteOS Network

Vulnerability Details :

CVE-2026-25077

Assigner-apache

Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At-08 May, 2026 | 12:21

Updated At-09 May, 2026 | 06:43

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apache

Assigner Org ID:f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At:08 May, 2026 | 12:21

Updated At:09 May, 2026 | 06:43

▼CVE Numbering Authority (CNA)

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Affected Products

Vendor

The Apache Software Foundation

Product

Apache CloudStack

Default Status

unaffected

Versions

Affected

From 4.11.0 through 4.20.2.0 (semver)
From 4.21.0.0 through 4.22.0.0 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics Other Info

Textual description of severity

text:

important

Credits

reporter

Reza at HazardLab (https://hazardlab.ninja)

References

Hyperlink	Resource
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm	vendor-advisory

Hyperlink: https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Metrics Other Info

2. CVE Program Container

References

Hyperlink	Resource
http://www.openwall.com/lists/oss-security/2026/05/09/6	N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2026/05/09/6

Resource: N/A

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@apache.org

Published At:08 May, 2026 | 13:16

Updated At:09 May, 2026 | 07:16

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CPE Matches

The Apache Software Foundation

>>cloudstack>>Versions from 4.11.0.0(inclusive) to 4.20.3.0(exclusive)

cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>cloudstack>>Versions from 4.21.0.0(inclusive) to 4.22.0.1(exclusive)

cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Secondary	security@apache.org

CWE ID: CWE-94

Type: Secondary

Source: security@apache.org

References

Hyperlink	Source	Resource
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm	security@apache.org	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/09/6	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm

Source: security@apache.org

Resource:

Mailing List

Vendor Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2026/05/09/6

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

157Records found

CVE-2025-4208

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.48% / 65.15%

7 Day CHG~0.00%

Published-08 May, 2025 | 11:13

Updated-08 Apr, 2026 | 16:40

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter).

Vendor-basixonline webaways

Product-nex-forms NEX-Forms – Ultimate Forms Plugin for WordPress

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2025-4022

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.30% / 53.50%

7 Day CHG~0.00%

Published-28 Apr, 2025 | 13:31

Updated-14 May, 2025 | 19:32

web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluation_harness/evaluators.py. The manipulation of the argument target["url"] leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Vendor-webarena web-arena-x

Product-webarena webarena

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-39209

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.3||MEDIUM

EPSS-0.25% / 48.42%

7 Day CHG~0.00%

Published-27 Jun, 2024 | 00:00

Updated-15 Apr, 2026 | 00:35

luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.

Vendor-n/a luci_app_sms_tool

Product-n/a luci_app_sms_tool

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-38990

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.3||MEDIUM

EPSS-0.17% / 38.35%

7 Day CHG~0.00%

Published-01 Jul, 2024 | 00:00

Updated-15 Apr, 2026 | 00:35

Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Vendor-n/a tada5hi

Product-n/a sp_common

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-39002

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.3||MEDIUM

EPSS-0.12% / 30.03%

7 Day CHG~0.00%

Published-01 Jul, 2024 | 00:00

Updated-07 Jul, 2025 | 20:20

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Vendor-richardrodger n/a rjrodger

Product-jsonic n/a jsonic-next

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-33335

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.3||MEDIUM

EPSS-1.71% / 82.44%

7 Day CHG~0.00%

Published-20 Jun, 2024 | 00:00

Updated-15 Apr, 2026 | 00:35

SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.

Vendor-n/a New H3C Technologies Co., Ltd.

Product-n/a seasql_dws

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-30567

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.3||MEDIUM

EPSS-2.70% / 85.97%

7 Day CHG~0.00%

Published-15 Apr, 2024 | 00:00

Updated-15 Apr, 2026 | 00:35

An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality.

Vendor-n/a jnt_telecom

Product-n/a jnt_liftcom_ums

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2026-25077

Credits

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs