Description
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.
Critical · 9.1
CVE-2025-67397
EUVD-2026-0804GHSA-qc6j-jvj6-wfr6
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific …
Published Jan 5, 2026 · Updated Jan 6, 2026 · Assigned by mitre