Paper/Archive/CVE-2025-8350

CVE-2025-8350

Inrove Software and Internet Services BiEticaret CMS — Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 49.8.498 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource

BiEticaret CMS2.1.13 – 19022026–CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-26-0077 refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0077