CVE-2025-25190

The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (XSS) vulnerability in its EchoProcess service prior to commit 7a5ae1a. The vulnerability exists because the EchoProcess service directly reflects user input in its output without proper sanitization when handling complex inputs.The service accepts various input formats including XML, JSON, and SVG, and returns the content based on the requested MIME type. When processing SVG content and returning it with the image/svg+xml MIME type, the server fails to sanitize potentially malicious JavaScript in attributes like onload, allowing arbitrary JavaScript execution in the victim's browser context. This vulnerability is particularly dangerous because it exists in a service specifically designed to echo back user input, and the lack of proper sanitization in combination with SVG handling creates a reliable XSS vector. Commit 7a5ae1a contains a fix for the issue.

• CWE-79

• https://github.com/ZOO-Project/ZOO-Project/commit/7a5ae1a10faa2f9877d18ec72550dc23e8ce1aac
• https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-2569-6r9f-j7jv
• https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-2569-6r9f-j7jv

Published

Feb 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25185GPT Academic provides interactive interfaces for large langu…7.5
• CVE-2025-25186Net::IMAP implements Internet Message Access Protocol (IMAP)…6.5
• CVE-2025-25187Joplin is a free, open source note taking and to-do applicat…5.4
• CVE-2025-25188Hickory DNS is a Rust based DNS client, server, and resolver…5.7
• CVE-2025-25189The ZOO-Project is an open source processing platform. A ref…5.5
• CVE-2025-2519The Sreamit theme for WordPress is vulnerable to arbitrary f…6.5
• CVE-2025-25191Group-Office is an enterprise CRM and groupware tool. This S…5.4
• CVE-2025-25192GLPI is a free asset and IT management software package. Pri…6.5
• CVE-2025-25193Netty, an asynchronous, event-driven network application fra…5.5
• CVE-2025-25194Lemmy, a link aggregator and forum for the fediverse, is vul…4
• CVE-2025-25195Zulip is an open source team chat application. A weekly cron…4.3
• CVE-2025-25196OpenFGA is a high-performance and flexible authorization/per…9.8