What’s Vulnerable › Vulnerabilities

CVE-2025-63314

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-12 · updated 2026-07-05
• Weakness: CWE-640

Description

A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

Affected products

• Ddsn Cm3 Acora Cms: 10.7.1

References

• https://github.com/padayali-JD/CVE-2025-63314

Get alerted when CVE-2025-63314 or the next vulnerability affects your stack