How severe is CVE-2025-33028?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.1 out of 10.

What type of vulnerability is CVE-2025-33028?

This is classified as CWE-830, which is a common weakness in software security.

CVE-2025-33028 - MEDIUM Severity | CVSS 6.1

Vulnerability Description

In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, WinZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.

Related Vulnerabilities

CVE-2021-28162

MEDIUM

CVSS:6.1(Medium)

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

CWE-8302021

CVE-2024-35180

MEDIUM

CVSS:6.1(Medium)

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JS...

CWE-8302024

CVE-2025-43703

MEDIUM

CVSS:6.1(Medium)

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) th...

CWE-8302025

CVE-2025-46652

MEDIUM

CVSS:6.1(Medium)

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extr...

CWE-8302025

CVE-2025-33026

HIGH

CVSS:7.8(High)

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. U...

CWE-8302025

CVE-2025-33027

HIGH

CVSS:7.8(High)

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of...

CWE-8302025