← Back

CVE-2025-47867

nvd nist
Published: Jun 17, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.

Affected (12)

Trendmicro
1 product
Apex Central
Configuration A
12 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Trendmicro
Apex Central
Version 2019
Apex Central
Version 2019 build_3752
Apex Central
Version 2019 build_5158
Apex Central
Version 2019 build_6016
Apex Central
Version 2019 build_6288
Apex Central
Version 2019 build_6394
Apex Central
Version 2019 build_6481
Apex Central
Version 2019 build_6511
Apex Central
Version 2019 build_6571
Apex Central
Version 2019 build_6658
Apex Central
Version 2019 build_6660
Apex Central
Version 2019 build_6890
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (2)

Source: security@trendmicro.com
Vendor Advisory
Source: security@trendmicro.com
Third Party Advisory

Timeline

No history available yet.