CVE-2025-25189

The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) publish.py CGI script prior to commit 7a5ae1a. The script reflects user input from the `jobid` parameter in its HTTP response without proper HTML encoding or sanitization. When a victim visits a specially crafted URL pointing to this endpoint, arbitrary JavaScript code can be executed in their browser context. The vulnerability occurs because the CGI script directly outputs the query string parameters into the HTML response without escaping HTML special characters. An attacker can inject malicious JavaScript code through the `jobid` parameter which will be executed when rendered by the victim's browser. Commit 7a5ae1a contains a fix for the issue.

• CWE-79

• https://github.com/ZOO-Project/ZOO-Project/commit/7a5ae1a10faa2f9877d18ec72550dc23e8ce1aac
• https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-pw7m-p9q7-357p
• https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-pw7m-p9q7-357p

Published

Feb 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25183vLLM is a high-throughput and memory-efficient inference and…2.6
• CVE-2025-25184Rack provides an interface for developing web applications i…6.5
• CVE-2025-25185GPT Academic provides interactive interfaces for large langu…7.5
• CVE-2025-25186Net::IMAP implements Internet Message Access Protocol (IMAP)…6.5
• CVE-2025-25187Joplin is a free, open source note taking and to-do applicat…5.4
• CVE-2025-25188Hickory DNS is a Rust based DNS client, server, and resolver…5.7
• CVE-2025-2519The Sreamit theme for WordPress is vulnerable to arbitrary f…6.5
• CVE-2025-25190The ZOO-Project is an open source processing platform. The Z…5.5
• CVE-2025-25191Group-Office is an enterprise CRM and groupware tool. This S…5.4
• CVE-2025-25192GLPI is a free asset and IT management software package. Pri…6.5
• CVE-2025-25193Netty, an asynchronous, event-driven network application fra…5.5
• CVE-2025-25194Lemmy, a link aggregator and forum for the fediverse, is vul…4