VULNERABILITY INTELLIGENCE

CVE-2025-43955

CVSS score9.8 CRITICAL

EPSS probability0.36%

CISA KEVNot currently listed

Published2025-04-20

Last modified2026-08-28

Description

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.