Improper input validation in Cordaware Bestinformed Web
CVE-2025-0423
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.005 (38.7th percentile) — read the EPSS interpretation.
Affected products
- Cordaware Bestinformed Web — versions 0, 6.2.2.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vulnerability@ncsc.ch (vendor-advisory)
Frequently asked questions
- What is CVE-2025-0423?
- CVE-2025-0423 is a vulnerability in Cordaware Bestinformed Web, classified under Improper Input Validation. Published 2025-02-18.
- Is CVE-2025-0423 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.