CVE-2025-7053

A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.

• CWE-79
• CWE-94
• CWE-79

• https://github.com/Cockpit-HQ/Cockpit/commit/bdcd5e3bc651c0839c7eea807f3eb6af856dbc76Patch
• https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.11.4Release Notes
• https://vuldb.com/?ctiid.314819Permissions Required, VDB Entry
• https://vuldb.com/?id.314819Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.605594Exploit, Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.605594Exploit, Third Party Advisory, VDB Entry

Published

Jul 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-70518The management portal's diagnostic ping tool of Fanvil x7a f…10
• CVE-2025-70519The device log component of Fanvil x7a firmware version 2.6.…6.1
• CVE-2025-7052The LatePoint plugin for WordPress is vulnerable to Cross-Si…8.8
• CVE-2025-70520The websocket handler of Fanvil x7a firmware version 2.6.0.1…9.8
• CVE-2025-70521The management portal's diagnostic ping tool of Fanvil x7a f…9.8
• CVE-2025-70522The request handler of Fanvil x7a firmware version 2.6.0.118…8.8
• CVE-2025-7054Cloudflare quiche was discovered to be vulnerable to an infi…6.5
• CVE-2025-70545A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2025-70559pdfminer.six before 20251230 contains an insecure deserializ…6.5
• CVE-2025-7056Improper Neutralization of Input During Web Page Generation …6.3
• CVE-2025-70560Boltz 2.0.0 contains an insecure deserialization vulnerabili…8.4
• CVE-2025-7057Improper Neutralization of Input During Web Page Generation …5.4