Uncontrolled resource consumption in Huggingface Transformers
CVSS score
7.5
EPSS probability
%0.5
Risk score
0.0
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
A fully automated exploit script for **CVE-2025-69212**, a command injection vulnerability in OpenSTAManager. This script authenticates with admin credentials, deploys a malicious PHP web shell via a crafted P7M file in a ZIP archive, and provides command execution or a reverse shell.
This repository contains a PoC exploit for CVE-2025-69212.
OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M (signed XML) file decoding function.
CVE-2025-69212 Proof-of-concept. Authenticated RCE in OpenSTAManager ≤2.9.8 via malicious ZIP uploads containing crafted .p7m filenames.
CVE-2025-69212 - OpenSTAManager OS Command Injection PoC
CVE-2025-69214 - OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f
Similar Vulnerabilities
Deserialization of untrusted data in Huggingface Lerobot
Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components
Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
Code injection in Huggingface Diffusers
Deserialization of untrusted data in Huggingface Transformers
peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-6921"