PT-2025-47112 · Thinplus · Thinplus

Published 2025-11-17 · Updated 2025-11-22 · CVE-2025-13284

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinPLUS (affected versions not specified)

Description ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability. This allows unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The vulnerability offers trivial remote code execution with zero barriers to entry.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-13284

Affected Products

Thinplus

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-13284 · Security Note
• https://twitter.com/cracbot/status/1992186341925486708 · Twitter Post
• https://t.me/cveNotify/142970 · Telegram Post
• https://twitter.com/SecAideInfo/status/1991088300963324048 · Twitter Post
• https://twitter.com/cracbot/status/1991823968454738382 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990277954299978183 · Twitter Post
• https://twitter.com/Cyberwarzonecom/status/1990418703880466820 · Twitter Post
• https://twcert.org.tw/en/cp-139-10513-0d82b-2.html · Note
• https://t.me/CVEtracker/37467 · Telegram Post
• https://twitter.com/CVEnew/status/1990265512194965765 · Twitter Post
• https://twcert.org.tw/tw/cp-132-10512-e196b-1.html · Note
• https://twitter.com/CveFindCom/status/1990278983213035666 · Twitter Post
• https://twitter.com/0dayPublishing/status/1990267367402745875 · Twitter Post