Improper input validation in Cordaware Bestinformed Web
CVE-2025-0423
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (40.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Cordaware Bestinformed Web — versions 0, 6.2.2.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.cordaware.com/changelog/en/version-6_4_0_4-release-13_02_2025.html (vendor-advisory)
Frequently asked questions
- What is CVE-2025-0423?
- CVE-2025-0423 is a vulnerability in Cordaware Bestinformed Web, classified under Improper Input Validation. Published 2025-02-18.
- Is CVE-2025-0423 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.