CVE-2025-33026

HIGH Year: 2025
CVSS v3 Score
7.8
High
Weakness Type
CWE-830
View all →

Vulnerability Description

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.

Related Vulnerabilities

CVE-2025-33027

HIGH
CVSS:7.8(High)

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of...

CWE-8302025

CVE-2024-42381

HIGH
CVSS:8.3(High)

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp sectio...

CWE-8302024

CVE-2024-29944

HIGH
CVSS:8.4(High)

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, i...

CWE-8302024

CVE-2023-2588

HIGH
CVSS:8.8(High)

Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can...

CWE-8302023

CVE-2021-28162

MEDIUM
CVSS:6.1(Medium)

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

CWE-8302021

CVE-2024-35180

MEDIUM
CVSS:6.1(Medium)

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JS...

CWE-8302024