THREATPORT/VULNERABILITY/CVE-2025-32778
HIGH SEVERITY

CVE-2025-32778

CVE-2025-32778 vulnerability

Severity
HIGH
EPSS
19.3%
EPSS pct
97th
Exploited
No known
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
Affected vendor
See references
Affected product
See references
Weakness type (CWE)
  • CWE-78 — OS Command Injection
Published
2025-04-15

Risk analysis

Its EPSS score of 19.3% reflects a moderate probability of exploitation activity in the wild over the next 30 days, placing it above 97% of all scored CVEs.

Check your external exposure to CVE-2025-32778

  • Confirm whether the affected software is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2025-32778.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2025-32778

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2025-32778 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2025-32778?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2025-32778.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH
CVE-2018-8789
Freerdp vulnerability
HIGH
CVE-2018-15978
Flash Player Desktop Runtime vulnerability
HIGH
CVE-2018-15979
Acrobat Dc vulnerability