The vulnerability resides in the GroovyShell.evaluate function within the NoticeController’s /execute component, allowing an attacker to inject and execute arbitrary Groovy code. This flaw facilitates remote code execution, granting attackers the ability to compromise the confidentiality, integrity, and availability of the affected system. The weakness is a classic example of CWE‑74 (Command Injection) combined with CWE‑94 (Code Injection via eval). The CVSS score of 5.3 indicates a moderate severity, and the availability of a public exploit raises practical risk. The existence of an /execute endpoint is inferred from the component name and reference, not explicitly documented in the formal description.

The affected software is DefaultFuction Notice‑System‑Managent version 2.0, as referenced in the CVE sources. No other versions are explicitly listed, and the product is written in Groovy. The CVE references point to a GitHub repository, implying that the code is publicly hosted. The product’s public exposure, including an /execute endpoint, is inferred from the references and component naming, not directly stated in the CVE data.

Risk is moderate due to the CVSS score of 5.3, but exploitation is feasible remotely via the publicly documented /execute endpoint. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The existence of a published exploit suggests the attack vector is likely an HTTP POST or similar request to the /execute path; this HTTP-based approach is inferred from the component description and the reference links. Successful exploitation would enable full remote code execution, compromising the entire system.