CVE-2025-0324
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- EPSS probability
- 0.40%
- CWE
- CWE-791
- Published
- 2025-06-02
- Last modified
- 2026-03-13
Affected products
- Axis Communications AB AXIS OS
- Axis Communications AB AXIS OS
Weakness type
Related vulnerabilities
- CVE-2026-86206 — Access control filter bypass allows unauthorised access to APIs
- CVE-2026-78140 — Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
- CVE-2026-75979 — xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
- CVE-2026-19929 — OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine
- CVE-2026-18632 — langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
- CVE-2026-11998 — AngularJS XSS via SCE resource URL sanitization bypass
- CVE-2026-48208 — Denial-of-Service via SVG Rendering in Ticket
- CVE-2026-9498 — Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine