CVE-2025-59737

🗓️ 02 Oct 2025 14:02:41Reported by INCIBEType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 11 Views🌐 WEB

AndSoft e-TMS 25.03 has command injection via POST to the m parameter in /clt/LOGINFRM_LXA.ASP.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2025-59737	2 Oct 202515:03	–	circl
CNNVD	AndSoft e-TMS 命令注入漏洞	2 Oct 202500:00	–	cnnvd
CNVD	AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23557)	13 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-59737 Multiple vulnerabilities in AndSoft's e-TMS	2 Oct 202514:02	–	cvelist
EUVD	EUVD-2025-32138	3 Oct 202520:07	–	euvd
NVD	CVE-2025-59737	2 Oct 202514:15	–	nvd
Positive Technologies	PT-2025-40357	2 Oct 202500:00	–	ptsecurity
Vulnrichment	CVE-2025-59737 Multiple vulnerabilities in AndSoft's e-TMS	2 Oct 202514:02	–	vulnrichment

NVD

Vulners

Node

andsoft e-tmsMatch25.03

[
  {
    "defaultStatus": "unaffected",
    "product": "e-TMS",
    "vendor": "AndSoft",
    "versions": [
      {
        "status": "affected",
        "version": "v25.03 version"
      }
    ]
  }
]

Source	Link
incibe	www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms

Parameter	Position	Path	Description	CWE
m	request body	/clt/LOGINFRM_LXA.ASP	OS command injection via parameter 'm' in POST to /clt/LOGINFRM_LXA.ASP allowing execution of system commands on the server.	CWE-78, CWE-77

02 Oct 2025 20:13Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

CVSS 49.3

EPSS0.00265

SSVC