Web-Check allows command Injection via Unvalidated URL in Screenshot API
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.3epss 19%
from disclosure to weapon124 days
Published on NVDApr 15
1st PoC+124d
metasploitApr 12
VulnCheck+248d
exploitation probability
19%top 3% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Lissy93 · web-checkpublic PoCs found — 2
githubgithub.com/00xCanelo/CVE-2025-32778★ 3vulncheckvulncheck.com/xdb/b1d5364ef659unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.