What’s Vulnerable › Vulnerabilities

CVE-2025-12916: Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-09 · updated 2026-10-18
• Weakness: CWE-74

Description

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.

Affected products

• Sangfor Operation and Maintenance Security Management System: from 3.0 before 3.0.11 — fixed in 3.0.11

How to fix

Upgrade to a fixed version: Sangfor Operation and Maintenance Security Management System 3.0.11. Check the vendor advisory for mitigations.

References

• https://h4cker.zip/post/fe0ada/
• https://vuldb.com/?ctiid.331634
• https://vuldb.com/?id.331634
• https://vuldb.com/?submit.678377
• https://h4cker.zip/post/fe0ada/

Get alerted when CVE-2025-12916 or the next vulnerability affects your stack