Unknown · Bestinformed Web · CVE-2025-0422
**Name of the Vulnerable Software and Affected Versions**
BestInformed Web (affected versions not specified)
**Description**
The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code execution. This can be achieved by creating `ScriptVars` with the type `script` and previewing them, for example, by creating a new information entry. By default, admin users have the necessary permissions, but with the granular permission system, these permissions can be assigned to other users as well. If an account with the correct permissions is compromised, an attacker can execute commands on the server running the BestInformed Web application.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.