CVE-2025-63334

CRITICAL 9.8CVE-2025-63334 · Published 05/11/2025 · updated 27/10/2026

In short

CVE-2025-63334 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.

References

gist.github.com/mamdouhalrekabi-ops/e7686a0bdd197c77c1b54191e1a2880f · Exploit
magdesign/PocketVJ-CP-v3 release release · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free