CVE-2025-57439

8.8 highEPSS 0.8%

High (8.8) in creacast creabox manager. EPSS 0.8% chance of exploitation in the next 30 days.

Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse shell execution or arbitrary command execution.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-09-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

creacast:creabox_manager

References

http://www.creacast.com/
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57439

Check your stack JSON