CVE-2025-62428CWE-601

CVE-2025-62428

published October 16, 2025

CVSS
8.8
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links. These links can redirect users to attacker-controlled domains. This vulnerability affects all users relying on email confirmation for account registration or verification. This vulnerability is fixed in 1.2.5-alpha-patch.

The record
Technical detail
CVSS
8.8 · NONE
CVSS v4.0
Not supplied
EPSS
0.00453 · 38.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-10-16T23:15Z
References (3)
https://github.com/Drawing-Captcha/Drawing-Captcha-APP/issues/30 · [email protected]https://github.com/Drawing-Captcha/Drawing-Captcha-APP/security/advisories/GHSA-5pj8-fc6g-vv7m · [email protected]https://github.com/Drawing-Captcha/Drawing-Captcha-APP/issues/30 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 18:57Z
    Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints
    cvelistv5