CVE-2025-55040

The CVE-2025-55040 affects MuraCMS up to version 10.1.10. The issue is a CSRF in the cForm.importform function that lacks CSRF token validation, allowing a malicious site to forge file-upload requests. When an authenticated administrator visits a crafted page and selects a ZIP containing attacker...

Remote code execution

libxl provides Node bindings for the libxl library for reading and writing excel XLS and XLSX spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an...