CVE-2020-25494: Xinuos Openserver

Critical severity, CVSS 9.8. EPSS: 39.2% chance of exploitation in the next 30 days.

Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.

Affected products

• Xinuos Openserver: version 5.0.7 only; version 6.0 only

Published 2020-12-18. Last modified 2026-06-17.