CVE-2025-59025

Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known

• CWE-79

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0003.json

Published

Nov 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5902A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and c…8.8
• CVE-2025-59020By exploiting the defVals parameter, attackers could bypass …6.5
• CVE-2025-59021Backend users with access to the redirects module and write …6.4
• CVE-2025-59022Backend users who had access to the recycler module could de…8.1
• CVE-2025-59023Crafted delegations or IP fragments can poison cached delega…8.2
• CVE-2025-59024Crafted delegations or IP fragments can poison cached delega…6.5
• CVE-2025-59026Malicious content uploaded as file can be used to execute sc…5.4
• CVE-2025-59028When sending invalid base64 SASL data, login process is disc…7.5
• CVE-2025-59029An attacker can trigger an assertion failure by requesting c…5.3
• CVE-2025-5903A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It h…8.8
• CVE-2025-59030An attacker can trigger the removal of cached records by sen…7.5
• CVE-2025-59031Dovecot has provided a script to use for attachment to text …4.3