CVE-2025-35036 – Apache Hibernate Expression Language Injection Vulnerability

June 3, 2025

CVE ID : CVE-2025-35036

Published : June 3, 2025, 8:15 p.m. | 1 hour, 30 minutes ago

Description : Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-5523 – Enilu Web-Flash Cross-Site Scripting Vulnerability

Next Article CVE-2025-23100 – Samsung Exynos NULL Check Denial of Service Vulnerability

Highlights

CVE-2025-48494 – Gokapi Stored Cross-Site Scripting Vulnerability

June 2, 2025

CVE ID : CVE-2025-48494

Published : June 2, 2025, 11:15 a.m. | 3 hours, 56 minutes ago

Description : Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Designing For TV: Principles, Patterns And Practical Guidance (Part 2)

Neo4j introduces new graph architecture that allows operational and analytics workloads to be run together

Beyond the benchmarks: Understanding the coding personalities of different LLMs

Top 10 Use Cases of Vibe Coding in Large-Scale Node.js Applications

Building smarter interactions with MCP elicitation: From clunky tool calls to seamless user experiences

From Zero to MCP: Simplifying AI Integrations with xmcp

Distribution Release: Linux Mint 22.2

Coded Smorgasbord: Basically, a Smorgasbord

Drupal 11’s AI Features: What They Actually Mean for Your Team

Drupal 11’s AI Features: What They Actually Mean for Your Team

Why Data Governance Matters More Than Ever in 2025?

Perficient Included in the IDC Market Glance for Digital Business Professional Services, 3Q25

How DevOps Teams Are Redefining Reliability with NixOS and OSTree-Powered Linux

How DevOps Teams Are Redefining Reliability with NixOS and OSTree-Powered Linux

Distribution Release: Linux Mint 22.2

‘Cronos: The New Dawn’ was by far my favorite experience at Gamescom 2025 — Bloober might have cooked an Xbox / PC horror masterpiece

CVE-2025-35036 – Apache Hibernate Expression Language Injection Vulnerability

Critical Linux UDisks Daemon Vulnerability (CVE-2025-8067) Exposes Privileged Data to Local Attackers

Google Slapped with $381 Million Fine in France Over Gmail Ads, Cookie Consent Missteps

Postbot–An AI Bot that Generates Scripts for You

Pinot is a real-time analytics platform

CVE-2025-52101 – Linjiashop JWT Authentication Access Control Bypass

DietPi – extremely lightweight Debian-based distribution

CVE-2025-48494 – Gokapi Stored Cross-Site Scripting Vulnerability

PUBLOAD and Pubshell Malware Used in Mustang Panda’s Tibet-Specific Attack

Google Cloud Unveils Gemini CLI: Free AI Assistant Brings Gemini 2.5 Pro to Your Terminal

A UN Human Rights Council report lists Microsoft among big tech companies that “profit” from Gaza genocide

CVE-2025-35036 – Apache Hibernate Expression Language Injection Vulnerability

Related Posts