Detections
Analytics

CVE-2025-63828

high

Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

References

https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt

https://github.com/mertdurum06/BackdropCms-1.32.1/

Details

Source: Mitre, NVD

Published: 2025-11-18

Updated: 2025-11-24

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 8.2

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Severity: High

EPSS

EPSS: 0.00018