CVE-2025-54945: Sun.net Ehrd Ctms

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.

Affected products

• Sun.net Ehrd Ctms: before 10.11 (fixed in 10.11)

Published 2025-08-30. Last modified 2026-06-17.