CVE-2025-2611: Ict Innovations Ictbroadcast

Critical severity, CVSS 9.3. EPSS: 8.1% chance of exploitation in the next 30 days.

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

Affected products

• Ict Innovations Ictbroadcast: up to and including 7.4

Published 2025-08-05. Last modified 2026-06-17.