CVE-2025-10327

low · 2.1

A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

2.1

CVSS

10.2%

EPSS (exploit prob.)

95th

EPSS percentile

2025-09-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-77CWE-78

Affected products

Vendor	Product	Affected versions
sourcefabric	rpi-jukebox-rfid	<= 2.8.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce4.md
https://vuldb.com/?ctiid.323753
https://vuldb.com/?id.323753
https://vuldb.com/?submit.643511
https://www.exploit-db.com/exploits/52468

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-10327