Eveo vulnerabilities
We track 5 vulnerabilities in Eveo products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 21, 2025.
Latest Eveo vulnerabilities
- 9.8 Critical severity
Urve Web Manager: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly
- 8.6 High severity
Urve Web Manager: Server-Side Request Forgery
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This
- 8.0 High severity
Web Manager: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local netwo
- 8.0 High severity
Web Manager: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this
- 8.0 High severity
Web Manager: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. Th