CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2023-25261

Critical · CVSS 9.8

Stimulsoft Designer/Viewer — Remote Code Execution via local file system access (CWE-94 Code Injection)

CVSS
9.8
nvd
EPSS
—
KEV
No
Class
other
NVD-CWE-noinfo, CWE-94

Description

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.

Search profile — drives PoC discovery

Symbols StimulsoftStiReportStiDesignerStiViewerreport templatescript injectionfile readfile writereport variablerender reportlocal file system
Keywords CVE-2023-25261Stimulsoft RCEStimulsoft Designer exploitStimulsoft Viewer exploitStimulsoft code injectionStimulsoft file system accessStimulsoft 2023.1.4 PoCStimulsoft 2023.1.3 PoCStimulsoft report script execution
Versions: Stimulsoft Designer (Desktop) 2023.1.4, Stimulsoft Designer (Web) 2023.1.3, Stimulsoft Viewer (Web) 2023.1.3

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z