CVE-2025-0539

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-05409.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknow CVE-2025-05419.8A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of th CVE-2025-05427.8Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server.CVE-2025-05437.8Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a l CVE-2025-05454.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Comm CVE-2025-05464.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or F CVE-2025-05474.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows C CVE-2025-05496.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and fro CVE-2025-05544.0The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 CVE-2025-05556.1A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 pri CVE-2025-05566.5In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communicati CVE-2025-05574.3A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. T