Vulnerability Description
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Backdropcms | Backdrop Cms | 1.32.1 |
Related Weaknesses (CWE)
References
- https://github.com/mertdurum06/BackdropCms-1.32.1/Release Notes
- https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.Exploit
- https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.Exploit
FAQ
What is CVE-2025-63828?
CVE-2025-63828 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hi...
How severe is CVE-2025-63828?
CVE-2025-63828 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-63828?
Check the references section above for vendor advisories and patch information. Affected products include: Backdropcms Backdrop Cms.