Dashboard / CVE-2025-63916

CVE-2025-63916

HIGH
MEDIUM Priority: 0.13 BB Relevance: 67/100
Published: 2025-11-17 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: None

Description

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
luotengyuan myscreentools < 2.2.1.0

References & Advisories (3)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

1.59%
Raw Score 0.015940
Percentile 76.1%
Date 2026-11-14

EPSS Trend

2026-11-14
0.01594
2026-11-13
0.01594
2026-11-12
0.01594
2026-11-10
0.01594
2026-11-09
0.01594
2026-11-08
0.01594
2026-11-07
0.01594
2026-11-06
0.01594
2026-11-05
0.01594

Intelligence Sources

nvd ref →

External Links