CVE-2025-4653highCWE-77

CVE-2025-4653: high-severity vulnerability in Pandora ITSM

Remote Code Execution leads to Command Injection

Published 10 Jun 2025

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7epss 3.4%

from disclosure to weaponsame day

Published on NVDJun 10

metasploitJun 10

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/R:U/V:D/RE:M/U:Green

Affected products

Related CVEs — Pandora ITSM

In the same product, most dangerous first.

References