CVE-2025-30004
CVSS v3
8.8
HIGH
EPSS Score
4.2 %
exploit probability, as of 2026-10-04
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
Technical details
- Published
- 2025-03-31
Frequently asked questions
What is CVE-2025-30004?
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
Is CVE-2025-30004 actively exploited?
Active exploitation of CVE-2025-30004 has not been confirmed. Its EPSS score was 4.2% on 2026-10-04, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-30004?
CVE-2025-30004 has a CVSS v3 base score of 8.8 (HIGH severity).
Is CVE-2025-30004 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2025 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).
- CVE-2025-53770KEVMicrosoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2025-49704KEVMicrosoft SharePoint Remote Code Execution Vulnerability
- CVE-2025-3248KEV
- CVE-2025-22457KEV
- CVE-2025-59287KEV
- CVE-2025-0282KEV
- CVE-2025-5777KEVNetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
- CVE-2025-31161KEV