CVE-2025-43955

PoC —

CVSS 3.1

6.8 medium

EPSS

<1%p27

Published

Apr 20, 2025 (Apr 20, 2025)

Modified

Aug 28, 2026

Description

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

Vendors: convertigo
Products: convertigo
Weakness: CWE-749, CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.