UpHeron
All vulnerabilities

Servers and applications

CVE-2025-63828

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

Severity
Medium 6.1
Published
18 Nov 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms
  • Version 1.32.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-63828
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-63828