PT-2026-22261

CVE-2026-25111

Published

2026-02-27

Updated

2026-03-10

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1

Description An OS command injection issue exists that allows a logged-in attacker to execute code remotely on the system. This is achieved by submitting crafted input to the restore route. The restore route is susceptible to command injection due to improper input validation. The vulnerable parameter is not specified.

Recommendations Update XWEB Pro to a version later than 1.12.1.

Exploitability

Fix

Impacts

Researchers

Amir Zaltzman

Noam Moshe

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers