Urve Web Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:eveo:urve_web_manager:27.02.2025:*:*:*:*:*:*:*
part: a version: 27.02.2025 update: *
| Vendor | Eveo (d94a2858-1101-5321-b45d-074a9cb7772e) |
|---|---|
| Product | Urve Web Manager (a06c40d0-e754-5e93-994b-6ef9f5c7d815) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-36846 |
vulnerable | 2026-06-08 07:21:02.159774 |
Details available
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.
Published: 2025-07-21T00:00:00.000Z
Updated: 2025-07-21T19:05:38.118Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36845 |
vulnerable | 2026-06-08 07:21:02.159394 |
Details available
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.
Published: 2025-07-21T00:00:00.000Z
Updated: 2025-07-21T19:00:44.901Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.