CVE Catalog
CVE-2025-67397
CriticalSummary
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.
Risk Assessment
An attacker with access to the application can execute arbitrary commands on the server, potentially leading to full system compromise.
Recommendation
It is recommended to update Passy to the latest version if a patch is available, and restrict access to the application.
Original NVD description (English source)
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.