Description

A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Eine kritische Schwachstelle wurde in hzmanyun Education and Training System 2.1 ausgemacht. Davon betroffen ist die Funktion exportPDF der Datei /user/exportPDF. Mit der Manipulation des Arguments id mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

Classification

CVE ID: CVE-2025-1946

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.3

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Products

Vendor: hzmanyun

Product: Education and Training System

Exploit Prediction Scoring System (EPSS)

EPSS Score: 1.47% (probability of being exploited)

EPSS Percentile: 79.22% (scored less or equal to compared to others)

EPSS Date: 2025-04-02 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: poc

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1946
https://vuldb.com/?id.298520
https://vuldb.com/?ctiid.298520
https://vuldb.com/?submit.506657
https://github.com/heiheixz/report/blob/main/nxb_1.md

Timeline