CVE-2025-63314 — CRITICAL (10.0)

Vulnerability Description

A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Ddsn	Cm3 Acora Cms	10.7.1

Related Weaknesses (CWE)

CWE-640

References

http://acora.comNot Applicable
http://ddsn.comProduct
https://github.com/padayali-JD/CVE-2025-63314Third Party Advisory

FAQ

What is CVE-2025-63314?

CVE-2025-63314 is a vulnerability with a CVSS score of 10.0 (CRITICAL). A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a rep...

How severe is CVE-2025-63314?

CVE-2025-63314 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-63314?

Check the references section above for vendor advisories and patch information. Affected products include: Ddsn Cm3 Acora Cms.