Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

🗓️ 15 Mar 2026 14:16:58Reported by symphony2colourType

githubexploit

githubexploit🔗 github.com👁 178 Views

Exploit for Markup Language Injection in FontTools; Blind path injection.

Reporter	Title	Published	Views	Family All 63
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	21 Mar 202616:36	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202610:43	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	28 Mar 202608:04	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	17 Mar 202620:03	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202622:57	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	7 Apr 202613:43	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	15 Mar 202614:16	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection Component uses fontTools dependency which is vulnerable to CVE-2025-66034.	17 Mar 202611:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an XML Injection in fonttools [CVE-2025-66034]	27 Feb 202615:45	–	ibm

15 Mar 2026 14:36Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.3 - 9.8

EPSS0.00496

SSVC

Markup Language Injection Path Query Injection FontTools