CVE-2019-12725: Zeroshell

Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days.

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

Affected products

• Zeroshell Zeroshell: version 3.9.0 only

Published 2019-07-19. Last modified 2026-06-17.