Dashboard / CVE-2025-63828

CVE-2025-63828

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2025-11-18 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
backdropcms backdrop_cms 1.32.1

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002290
Percentile 13.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00229
2026-11-12
0.00229
2026-11-10
0.00229
2026-11-09
0.00229
2026-11-08
0.00229
2026-11-07
0.00229
2026-11-06
0.00229
2026-11-05
0.00229

Intelligence Sources

nvd ref →

External Links