CVE-2025-6512 CRITICAL

CVE-2025-6512: Scripts within reports executable on BRAIN2 Server

Vendor Bizerba Se & Co. Kg

Product BRAIN2

Weakness CWE-94 · Code injection

Published June 23, 2025

Last update June 23, 2025

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.

Key dates

02Disclosure timeline

June 23, 2025 CVE published

June 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-6512 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2024-4662 Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution CVE-2026-7595 nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injection CVE-2025-36014 IBM Integration Bus for z/OS code injection CVE-2020-8129 CVE-2025-6204 Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025