First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-67741

MediumCVSS 5.4/10Last modified Oct 7, 2026

Description

In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	TeamCity	< 2025.11

References

https://www.jetbrains.com/privacy-security/issues-fixed/Issue Tracking, Vendor Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-677427.5In JetBrains TeamCity before 2025.11 path traversal was possible via file upload CVE-2025-677436.5Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download s CVE-2025-677449.6DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security CVE-2025-677457.5MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases,CVE-2025-677464.3Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that CVE-2025-677477.8Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list CVE-2025-677487.8Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block li CVE-2025-677495.3PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy o CVE-2025-67759.8A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of CVE-2025-677508.4Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versi CVE-2025-677517.2ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` CVE-2025-677528.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's H

CVE-2025-67741: Medium severity, CVSS 5.4 | Vulnix