mamdouhalrekabi-ops

CVE-2025-63334 - Unauthenticated RCE in PocketVJ CP v3

Executive Summary

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains a critical unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.

---

Vulnerability Details

Vulnerability Type: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products: PocketVJ CP (PocketVJ-CP-v3) versions 3.9.1 and earlier

mamdouhalrekabi-ops

CVE-2025-45326: Remote Code Execution in PocketVJ CP (pvj 3.9.1)

Product: PocketVJ CP
Affected Versions: pvj 3.9.1
Vulnerability Type: Remote Code Execution (RCE)

Description:
An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.php component. The vulnerable code uses shell_exec(), exec(), and system() functions without proper sanitization.

Attack Vector: