Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

🗓️ 17 Mar 2026 20:03:15Reported by ConradKashType

Exploit for XML Injection (Blind XPath) in Fonttools CVE-2025-66034 PoC to obtain RCE on Hack The Box VariaType.

Reporter	Title	Published	Views	Family All 63
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	21 Mar 202616:36	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202610:43	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	28 Mar 202608:04	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202622:57	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	15 Mar 202614:16	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	7 Apr 202613:43	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	15 Mar 202614:16	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection Component uses fontTools dependency which is vulnerable to CVE-2025-66034.	17 Mar 202611:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an XML Injection in fonttools [CVE-2025-66034]	27 Feb 202615:45	–	ibm

17 Mar 2026 20:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.3 - 9.8

EPSS0.00487

SSVC