CVE-2025-34302: Improper Neutralization of Input During Web Page Generation

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST...

CVE-2025-3984

CVE-2025-3984 affects Apereo CAS 5.2.6. The vulnerability targets the saveService function in cas-5.2.6/webapp-mgmt/cas-management-webapp-support/src/main/java/org/apereo/cas/mgmt/services/web/RegisteredServiceSimpleFormController.java (Groovy Code Handler), enabling code injection. Reported as n...

CVE-2025-3984 Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

PT-2025-18015

Name of the Vulnerable Software and Affected Versions Apereo CAS version 5.2.6 Description A critical issue was found, affecting the saveService function of the RegisteredServiceSimpleFormController.java file in the Groovy Code Handler component. This issue leads to code injection and can be...

CVE-2025-3984: Improper Control of Generation of Code

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...