CVE-2025-63828

Exploit

EPSS 0.03%
Veröffentlicht 18.11.2025 00:00:00
Zuletzt bearbeitet 24.11.2025 14:02:35
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Backdropcms ≫ Backdrop Cms Version1.32.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.065

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://github.com/mertdurum06/BackdropCms-1.32.1/

Release Notes

https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2025-63828

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-63828

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-63828

EUVD