CVSS 4.0
9.2 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:NCVE-2025-0632
Critical (9.2). EPSS 0.9% chance of exploitation in the next 30 days.
Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.
This issue affects Rock Maker Web: from 3.2.1.1 and later
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-98
- Published
- Modified
- Record from
- the NVD, synced