CVE-2025-63334: Magdesign Pocketvj Control Panel Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.

Affected products

• Magdesign Pocketvj Control Panel Firmware: version 3.9.1 only

Published 2025-11-05. Last modified 2026-06-17.