Lutece
Monthly
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.