languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Command Injection
Pixelstor 5000 Firmware
Rasilient
NVD
Exploit-DB
CVSS 3.1
9.8
EPSS
10.6%