MiczFlor RPi-Jukebox-RFID playsinglefile.php os command injection_CVE-2025-10328

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2025-10328

Source VulDB

Published Sep 12, 2025 at 21:32

Affected Product

Vendor MiczFlor

Product RPi-Jukebox-RFID

Version 2.0

Affected Versions MiczFlor RPi-Jukebox-RFID 2.0
MiczFlor RPi-Jukebox-RFID 2.1
MiczFlor RPi-Jukebox-RFID 2.2
MiczFlor RPi-Jukebox-RFID 2.3
MiczFlor RPi-Jukebox-RFID 2.4
MiczFlor RPi-Jukebox-RFID 2.5
MiczFlor RPi-Jukebox-RFID 2.6
MiczFlor RPi-Jukebox-RFID 2.7
MiczFlor RPi-Jukebox-RFID 2.8.0

CWE Classification

CWE-78 CWE-77

References

{
    "lastseen": "",
    "description": "A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2025-09-12T21:32:08.718Z",
    "modified": "2025-09-12T21:32:08.718Z",
    "type": "cve",
    "title": "MiczFlor RPi-Jukebox-RFID playsinglefile.php os command injection",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.323754\nhttps://vuldb.com/?ctiid.323754\nhttps://vuldb.com/?submit.643512\nhttps://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce5.md",
    "id": "CVE-2025-10328",
    "bulletinFamily": "",
    "cwe": [
        "CWE-78",
        "CWE-77"
    ],
    "cvelist": null,
    "sourceData": "MiczFlor RPi-Jukebox-RFID 2.0\nMiczFlor RPi-Jukebox-RFID 2.1\nMiczFlor RPi-Jukebox-RFID 2.2\nMiczFlor RPi-Jukebox-RFID 2.3\nMiczFlor RPi-Jukebox-RFID 2.4\nMiczFlor RPi-Jukebox-RFID 2.5\nMiczFlor RPi-Jukebox-RFID 2.6\nMiczFlor RPi-Jukebox-RFID 2.7\nMiczFlor RPi-Jukebox-RFID 2.8.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "RPi-Jukebox-RFID",
    "version": "2.0",
    "vendor": "MiczFlor",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}