Read the docs
TI-2025-04608 Aliases CVE-2025-5139GHSA-6mmm-jmjg-qxjf

Qualitor Office 365-type Connection testaConexaoOffice365.php command injection

Priority LOW 39CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was found in Qualitor 8.20/8.24. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php of the component Office 365-type Connection Handler. The manipulation of the argument nmconexao leads to command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.20.56 and 8.24.31 is able to address this issue. It is recommended to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0269 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed Qualitor: 8.20.56, 8.24.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Qualitor8.20; 8.248.20.56, 8.24.31Patch availableCNA
  • Qualitor Vendor— Affected 8.20; 8.24 Fixed in 8.20.56, 8.24.31 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:qualitor:qualitor:8.20:*:*:*:*:*:*:*8.20VulnerableQualitor
cpe:2.3:a:qualitor:qualitor:8.24:*:*:*:*:*:*:*8.24VulnerableQualitor
  • cpe:2.3:a:qualitor:qualitor:8.20:*:*:*:*:*:*:* Versions 8.20 Vulnerable ·Qualitor
  • cpe:2.3:a:qualitor:qualitor:8.24:*:*:*:*:*:*:* Versions 8.24 Vulnerable ·Qualitor

Remediation

  • Fix · CNA Qualitor Fixed in 8.20.56, 8.24.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5139
  2. 2026-10-03 Alias added: GHSA-6mmm-jmjg-qxjf

References

Exploit 2

  • TI-2024-30017 Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-25571 Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in… CVSS 3.1CRITICAL 9.8
  • TI-2024-32368 Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2024-32369 Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 7.5
  • TI-2025-13321 Qualitor viewDocumento.php cross site scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences