CVE-2025-0422

An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. Remote Code Execution For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By defaul...

CVE-2025-0422

Cordaware bestinformed Web is affected by CVE-2025-0422: an authenticated user who can create ScriptVars of type 'script' and preview them (e.g., via Info) can execute commands on the server, i.e., Remote Code Execution. Admin permissions enable this by default, but granular permissions can allow...