CVE-2025-0422

Name of the Vulnerable Software and Affected Versions BestInformed Web (affected versions not specified)

Description The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code execution. This can be achieved by creating ScriptVars with the type script and previewing them, for example, by creating a new information entry. By default, admin users have the necessary permissions, but with the granular permission system, these permissions can be assigned to other users as well. If an account with the correct permissions is compromised, an attacker can execute commands on the server running the BestInformed Web application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.