Improper input validation in Cordaware Bestinformed Web
CVE-2025-0424
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their session using an "Authenticated Stored Cross-Site Scripting". Those other users might have more privileges than the attacker, enabling a form of horizontal movement.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.004 (35.2th percentile) — read the EPSS interpretation.
Affected products
- Cordaware Bestinformed Web — versions 0, 6.2.2.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vulnerability@ncsc.ch (vendor-advisory)
Frequently asked questions
- What is CVE-2025-0424?
- CVE-2025-0424 is a vulnerability in Cordaware Bestinformed Web, classified under Improper Input Validation. Published 2025-02-18.
- Is CVE-2025-0424 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.