This vulnerability in elecV2 elecV2P (up to version 3.8.3) allows remote code injection via the runJSFile function in the /webhook endpoint. Specifically, the JSON Parser component improperly handles the rawcode argument, enabling an attacker to inject malicious code. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. The exploit is publicly available, but the vendor has not issued a fix or advisory.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially compromising system integrity and confidentiality. The impact is rated medium severity with limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

No official patch or vendor advisory is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the /webhook endpoint and monitor for suspicious activity related to the rawcode parameter. Avoid exposing the vulnerable versions to untrusted networks.