CVE-2025-10659 — MegaSys Enterprises Telenium Online Web Application OS Command Injection
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerabili…
Published: 2025-09-30 · CVSS: 9.3 · CVSS 4.0
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7