CVE-2019-25441 — thesystem 1.0 Command Injection via run_command endpoint
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_comm…
Published: 2026-02-20 · CVSS: 9.3 · CVSS 4.0
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7