Is there a public PoC exploit available for CVE-2025-8259?

Yes, a public proof-of-concept exploit is available for CVE-2025-8259. Prioritise patching immediately. EPSS: 0.9%.

VaelsysV4 CVE-2025-8259

Q: What is the CVSS score of CVE-2025-8259?

CVE-2025-8259 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

MEDIUM

Command Injection (CWE-77)

2025-07-28 cna@vuldb.com

PHP Command Injection Vaelsys

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable OS command injection with no complexity barriers warrants PR:N, AC:L, and full C/I/A with scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:49 vuln.today

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 28, 2025 - 06:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 5.1.1 and 5.4.1 can resolve this issue. It is suggested to upgrade the affected component.

AnalysisAI

OS command injection in Vaelsys VaelsysV4 (versions up to 5.1.0 and 5.4.0) allows remote unauthenticated attackers to execute arbitrary operating system commands via the xajaxargs parameter passed to the execute_DataObjectProc function in /grid/vgrid_server.php. The attack is fully remote, requires no authentication per the CVSS 4.0 PR:N metric, and a public proof-of-concept exploit is confirmed available on GitHub, raising the urgency of remediation. No active exploitation has been confirmed by CISA KEV at time of analysis, though an EPSS at the 75th percentile reflects non-trivial exploitation probability relative to the broader CVE population.

Technical ContextAI

VaelsysV4 is a PHP-based platform exposing a web interface endpoint at /grid/vgrid_server.php that leverages the xajax PHP AJAX framework to handle dynamic requests. The vulnerable function execute_DataObjectProc accepts user-controlled input via the xajaxargs parameter and passes it to an OS-level command execution context without adequate sanitization, constituting CWE-77 (Improper Neutralization of Special Elements used in a Command). This class of flaw arises when PHP code constructs shell commands using attacker-supplied values without escaping or allowlisting, enabling injection of arbitrary shell metacharacters. The CPE cpe:2.3:a:vaelsys:vaelsys:4.1.0 confirms the affected product line; description data extends the affected range to the 5.x branch up to 5.1.0 and 5.4.0. The vgrid naming convention and PHP stack suggest this is likely a video surveillance grid or similar industrial monitoring platform.

RemediationAI

The vendor has released patched versions 5.1.1 and 5.4.1, which resolve this vulnerability; upgrading to these versions is the primary and recommended remediation action. Consult the vendor security advisory at https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0001.html for upgrade instructions and any additional guidance. If immediate patching is not feasible, restrict network access to the /grid/vgrid_server.php endpoint via a web application firewall or network ACL to limit exposure to trusted management networks only; note this is a compensating control, not a fix, and does not eliminate the vulnerability. Disabling xajax-driven endpoints at the web server layer (e.g., via location blocks in nginx or Apache mod_rewrite rules targeting vgrid_server.php) can further reduce attack surface but may break core platform functionality. The public PoC's existence means exploitation attempts may appear in logs targeting the xajaxargs POST parameter; enable web server logging and monitor for anomalous argument patterns as a detection measure.