THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-43955 (LOW 2.2) — TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibr

[NVD] CVE-2025-43955 (LOW 2.2) — TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibr

lownvdPublished 2025-04-20

CVE-2025-43955 CVSS: 2.2 LOW Published: 2025-04-20T20:15:13.553

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

Indicators of compromise

CVE-2025-43955cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-43955