https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 22:08:10 +0000 https://vulnerability.circl.lu/sighting/161a275a-2452-4347-985f-d9bb76e8eca6/export {"uuid": "161a275a-2452-4347-985f-d9bb76e8eca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvt27tyncd2r", "content": "CVE-2025-53837 - org.xwiki.rendering:xwiki-rendering-xml\nAnyone who can edit their own profile or other pages in XWiki can insert hidden code that runs on the server, giving them full read and write access to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#xwiki #Java #CVE #infosec", "creation_timestamp": "2026-09-18T20:50:07.668941Z"} {"uuid": "161a275a-2452-4347-985f-d9bb76e8eca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvt27tyncd2r", "content": "CVE-2025-53837 - org.xwiki.rendering:xwiki-rendering-xml\nAnyone who can edit their own profile or other pages in XWiki can insert hidden code that runs on the server, giving them full read and write access to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#xwiki #Java #CVE #infosec", "creation_timestamp": "2026-09-18T20:50:07.668941Z"} https://vulnerability.circl.lu/sighting/161a275a-2452-4347-985f-d9bb76e8eca6/export Fri, 18 Sep 2026 20:50:07 +0000 https://vulnerability.circl.lu/sighting/b4ea2a70-9bc5-444f-a637-1f9061427953/export {"uuid": "b4ea2a70-9bc5-444f-a637-1f9061427953", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvsr5gnh3a2g", "content": "\ud83d\udea8 CVE-2025-53837 \u2014 CVSS 9.9 CRITICAL\n\nXWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, H...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-53837\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-18T18:07:42.681977Z"} {"uuid": "b4ea2a70-9bc5-444f-a637-1f9061427953", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvsr5gnh3a2g", "content": "\ud83d\udea8 CVE-2025-53837 \u2014 CVSS 9.9 CRITICAL\n\nXWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, H...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-53837\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-18T18:07:42.681977Z"} https://vulnerability.circl.lu/sighting/b4ea2a70-9bc5-444f-a637-1f9061427953/export Fri, 18 Sep 2026 18:07:42 +0000 https://vulnerability.circl.lu/sighting/81852359-91d4-4cfc-84f9-154e9292e1ef/export {"uuid": "81852359-91d4-4cfc-84f9-154e9292e1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://gist.github.com/alon710/167c49d842b30884b7c5e7737ec5f46c", "content": "# CVE-2025-53837: CVE-2025-53837: Remote Code Execution in XWiki Rendering via Macro Escape Injection\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2025-53837\n\n## Summary\nCVE-2025-53837 is a critical remote code execution (RCE) vulnerability in XWiki Rendering before versions 14.10.2 and 15.0 RC1. The vulnerability arises from a failure to escape macro closing tags within raw output handled by HTML macro blocks. This allows low-privilege users to escape the restricted HTML container and execute high-privilege scripts under the application's context.\n\n## TL;DR\nUnauthenticated or low-privilege users can inject the \"{{/html}}\" sequence to escape HTML macro scopes and run arbitrary code on the host OS via privileged script macros.\n\n## Technical Details\n\n- **Improproper Input Validation**: An issue was discovered in NETGEAR R6080 routers through 1.0.0.46. The login.cgi and upgrade.cgi pages and multiple dynamic parameters (such as formUsername, hidden_sysPassword, sysPassword, save_reboot, and select_country) are vulnerable to buffer overflow. An attacker can hijack a stack variable and crash the system or execute arbitrary code with admin privileges by writing over boundary limits of variables.\n\n## Affected Systems\n\n- cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*\n\n## Mitigation\n\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-53837) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T16:31:38.563039Z"} {"uuid": "81852359-91d4-4cfc-84f9-154e9292e1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53837", "type": "seen", "source": "https://gist.github.com/alon710/167c49d842b30884b7c5e7737ec5f46c", "content": "# CVE-2025-53837: CVE-2025-53837: Remote Code Execution in XWiki Rendering via Macro Escape Injection\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2025-53837\n\n## Summary\nCVE-2025-53837 is a critical remote code execution (RCE) vulnerability in XWiki Rendering before versions 14.10.2 and 15.0 RC1. The vulnerability arises from a failure to escape macro closing tags within raw output handled by HTML macro blocks. This allows low-privilege users to escape the restricted HTML container and execute high-privilege scripts under the application's context.\n\n## TL;DR\nUnauthenticated or low-privilege users can inject the \"{{/html}}\" sequence to escape HTML macro scopes and run arbitrary code on the host OS via privileged script macros.\n\n## Technical Details\n\n- **Improproper Input Validation**: An issue was discovered in NETGEAR R6080 routers through 1.0.0.46. The login.cgi and upgrade.cgi pages and multiple dynamic parameters (such as formUsername, hidden_sysPassword, sysPassword, save_reboot, and select_country) are vulnerable to buffer overflow. An attacker can hijack a stack variable and crash the system or execute arbitrary code with admin privileges by writing over boundary limits of variables.\n\n## Affected Systems\n\n- cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*\n\n## Mitigation\n\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-53837) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T16:31:38.563039Z"} https://vulnerability.circl.lu/sighting/81852359-91d4-4cfc-84f9-154e9292e1ef/export Fri, 18 Sep 2026 16:31:38 +0000