CVE-2025-13064

A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.

Score

CVSS 3.1 4.5 Medium

Status

Analyzed - product-security@axis.com

Published

2026-02-10

Last modified

2026-02-10

Weaknesses

CWE-248

Affected products

• Camera Station Pro (Axis)
• Axis Camera Station Pro (Axis Communications Ab)

References

• https://www.axis.com/dam/public/a9/9e/94/cve-2025-13064pdf-en-US-519290.pdf