Improper input validation in Cordaware Bestinformed Web
CVE-2025-0424
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their session using an "Authenticated Stored Cross-Site Scripting". Those other users might have more privileges than the attacker, enabling a form of horizontal movement.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (36.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Cordaware Bestinformed Web — versions 0, 6.2.2.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.cordaware.com/changelog/en/version-6_4_0_4-release-13_02_2025.html (vendor-advisory)
Frequently asked questions
- What is CVE-2025-0424?
- CVE-2025-0424 is a vulnerability in Cordaware Bestinformed Web, classified under Improper Input Validation. Published 2025-02-18.
- Is CVE-2025-0424 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.