CVE-2025-54571
MEDIUMDescription
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Is your site exposed to CVE-2025-54571?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| owasp | modsecurity |
References
Advisories & Patches
Exploits
Other References
Frequently Asked Questions
What is CVE-2025-54571? +
How severe is CVE-2025-54571? +
What products are affected by CVE-2025-54571? +
How do I check if I'm vulnerable to CVE-2025-54571? +
Related Vulnerabilities
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary …
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an …
The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial …
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic …
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from …
In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in unconditionally returning false.