CVE-2025-57738

CVE-2025-57738 affects Apache Syncope where Groovy-based extensions can be injected by a privileged administrator to execute code remotely. The cited advisories describe that Groovy code execution arises from runtime-loaded Groovy implementations, enabling remote execution within a running Syncop...

CVE-2025-65998

CVE-2025-65998 affects Apache Syncope where storing user passwords in the internal database with AES can expose cleartext passwords if the AES key is hard-coded in the source. The issue occurs when the AES option is enabled; the default key value is always used, enabling an attacker with internal...