Cyber Resilience

CVE-2025-60785

HighPublic PoCRCE

Published: 03 November 2025

Published
03 November 2025
Modified
04 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0040 61.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60785 is a high-severity Code Injection (CWE-94) vulnerability in Kagilum Icescrum. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-60785 is a remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem. Published on 2025-11-03T16:15:35.470, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H) and maps to CWE-94 (code injection). The issue enables attackers to execute arbitrary code by luring victims into interacting with a crafted HTML page.

Remote attackers can exploit this vulnerability over the network with low attack complexity and no authentication or privileges required, though user interaction is necessary, such as opening the malicious HTML page in a browser. Successful exploitation results in high impacts to confidentiality, integrity, and availability, allowing arbitrary code execution on the targeted iceScrum instance.

For details on mitigation, patches, or workarounds, refer to the advisory at https://zdaylabs.com/CVE-2025-60785.html.

EU & UK References

Vulnerability details

A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a remote code execution in a public-facing web application (iceScrum) exploitable over the network without authentication via a crafted HTML page, directly enabling T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-60786Same product: Kagilum Icescrum
CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94
CVE-2026-42555Shared CWE-94

Affected Assets

kagilum
icescrum
7.54

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and remediation of flaws like this RCE vulnerability in the Postgres Drivers, directly preventing exploitation.

SI-10 Information Input Validation good match
prevent

Mandates validation of all information inputs to the Postgres Drivers component, blocking code injection (CWE-94) from crafted HTML pages.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection mechanisms to prevent and detect arbitrary code execution resulting from the RCE vulnerability.

References