What’s Vulnerable › Vulnerabilities

CVE-2025-63828

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-18 · updated 2026-06-17
• Weakness: CWE-601

Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

Affected products

• BackdropCMS Backdrop: 1.32.1

References

• https://github.com/mertdurum06/BackdropCms-1.32.1/
• https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt
• https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt

Get alerted when CVE-2025-63828 or the next vulnerability affects your stack