CVE-2023-25621

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps). Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.

• https://sling.apache.org/news.htmlProduct
• https://sling.apache.org/news.htmlProduct

Published

Feb 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25616In some scenario, SAP Business Objects Business Intelligence…8.8
• CVE-2023-25617SAP Business Object (Adaptive Job Server) - versions 420, 43…8.8
• CVE-2023-25618SAP NetWeaver Application Server for ABAP and ABAP Platform …6.5
• CVE-2023-25619 A CWE-754: Improper Check for Unusual or Exceptional Condit…7.5
• CVE-2023-2562The Gallery Metabox for WordPress is vulnerable to unauthori…4.3
• CVE-2023-25620 A CWE-754: Improper Check for Unusual or Exceptional Cond…6.5
• CVE-2023-2563The WordPress Contact Forms by Cimatti plugin for WordPress …4.3
• CVE-2023-25632The Android Mobile Whale browser app before 3.0.1.2 allows t…5.5
• CVE-2023-2564OS Command Injection in GitHub repository sbs20/scanservjs p…10
• CVE-2023-25642 There is a buffer overflow vulnerability in some ZTE mobile…6.5
• CVE-2023-25643 There is a command injection vulnerability in some ZTE mo…8.8
• CVE-2023-25644 There is a denial of service vulnerability in some ZTE mobi…7.5