CVE-2025-10326
MiczFlor RPi-Jukebox-RFID single.php os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 12, 2025
- Updated
- Sep 15, 2025
- Reserved
- Sep 12, 2025
Description
A security flaw has been discovered in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Performing manipulation of the argument playlist results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
RPi-Jukebox-RFIDMiczFlor |
|
References
- VDB-323752 | MiczFlor RPi-Jukebox-RFID single.php os command injectionvdb-entrytechnical-description
- VDB-323752 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #643500 | MiczFlor RPi-Jukebox-RFID 2.8.0 Command Injectionthird-party-advisory
- https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.mdrelated
- https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.md#pocexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.