CVE-2025-60785
Published: 03 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-60785 is a remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem. Published on 2025-11-03T16:15:35.470, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H) and maps to CWE-94 (code injection). The issue enables attackers to execute arbitrary code by luring victims into interacting with a crafted HTML page.
Remote attackers can exploit this vulnerability over the network with low attack complexity and no authentication or privileges required, though user interaction is necessary, such as opening the malicious HTML page in a browser. Successful exploitation results in high impacts to confidentiality, integrity, and availability, allowing arbitrary code execution on the targeted iceScrum instance.
For details on mitigation, patches, or workarounds, refer to the advisory at https://zdaylabs.com/CVE-2025-60785.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a remote code execution in a public-facing web application (iceScrum) exploitable over the network without authentication via a crafted HTML page, directly enabling T1190: Exploit Public-Facing Application.