CVE-2025-4641

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java.

This issue affects webdrivermanager: from 1.0.0 before 6.0.2.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
bonigarcia	webdrivermanager	>= 1.0.0, < 6.0.2

References

https://github.com/bonigarcia/webdrivermanager/pull/1458

Timeline

Published: May 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-464106.1A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 a CVE-2025-464119.8A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-464129.8Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.CVE-2025-464135.3Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, CVE-2025-464148.1The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attac CVE-2025-464153.2A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.CVE-2025-464162.9The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc CVE-2025-464177.5The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS afte CVE-2025-464187.6Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.CVE-2025-464195.9Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.CVE-2025-464206.5A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list t CVE-2025-464216.8A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new