CVE-2025-59476

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-117

Affected software

No affected versions have been published.

Timeline

Published: Sep 17, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-594787.5When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic M CVE-2025-594796.1CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content CVE-2025-59489.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu CVE-2025-594806.5Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious CVE-2025-594818.7A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at CVE-2025-594828.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-594836.5A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Tec CVE-2025-594848.3The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies CVE-2025-594854.8Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an CVE-2025-594878.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-594897.4Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f CVE-2025-59498.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu