Medium severity · published Feb 10, 2026
CVE-2025-13064
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AXIS Camera Station Pro · Axis Communications AB
6 before 6.14 · source: vendor
CS
Camera Station Pro · Axis
before 6.14.10768 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13064
Vendor Advisory
https://www.axis.com/dam/public/a9/9e/94/cve-2025-13064pdf-en-US-519290.pdf
More from AXIS Camera Station Pro
7.8
CVE-2025-11547
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user
7.1
CVE-2026-63286
Database backups are vulnerable to offline attacks
6.3
CVE-2024-7696
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS…
5.7
CVE-2025-12063
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions
4.6
CVE-2025-12757
An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to