Vulnerability · Published Mar 4, 2025 · Assigned by VulDB
CVE-2025-1946hzmanyun Education and Training System exportPDF command injection
Medium 6.3
In plain English
A medium-severity command injection in Education and Training System from hzmanyun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)5.2%top 7.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hzmanyun | Education and Training System | 2.1 |
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-298520 | hzmanyun Education and Training System exportPDF command injection vdb-entry, technical-description
- VDB-298520 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #506657 | hzmanyun.com education and training system v2.1 Command Injection To RCE third-party-advisory
- https://github.com/heiheixz/report/blob/main/nxb_1.md exploit