CVE-2025-63334

Critical · 9.8

CVSS

9.8

EPSS

1.2%

Published

Nov 5, 2025

CISA due date

—

The record

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.

Affected packages

Ecosystem	Package	Introduced	Fixed