High severity · published Jun 10, 2025
CVE-2025-4653
Remote Code Execution leads to Command Injection
7.0
CVSS
3.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pandora ITSM · Pandora FMS
5.0.105 before 5.0.106 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4653
pandorafms.com
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
More from Pandora ITSM
7.0
CVE-2025-4678
Remote Code Execution leads to Command Injection