CRITICAL🇵🇱 Wersja polska

CVE-2023-25261

CVSS 9.8v3.1pub. 2023-03-27upd. 2026-07-05

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Stimulsoft Designer

    APP
    Stimulsoft
    2023.12023.1.32023.1.4

  • Stimulsoft Viewer

    APP
    Stimulsoft
    2023.1.32023.1.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-25260HIGH7.5ten sam produkt

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.

CVE-2023-25262HIGH7.5ten sam produkt

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe R...

CVE-2023-25263MEDIUM5.5ten sam produkt

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll...

CVE-2024-24398CRITICAL9.8PL ✓ten sam vendor

Path Traversal umożliwiający RCE w Stimulsoft Dashboard.JS

CVE-2021-42777CRITICAL9.8ten sam vendor

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execut...