CVE-2025-62428

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-62428

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-62428.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2025-62428

Aliases

GHSA-5pj8-fc6g-vv7m

Published

2025-10-16T18:57:14.114Z

Modified

2025-12-02T20:17:00.878983Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints

Details

Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links. These links can redirect users to attacker-controlled domains. This vulnerability affects all users relying on email confirmation for account registration or verification. This vulnerability is fixed in 1.2.5-alpha-patch.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62428.json",
    "cwe_ids": [
        "CWE-601"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/drawing-captcha/drawing-captcha-app

Affected ranges

Type

GIT

Repo

https://github.com/drawing-captcha/drawing-captcha-app

Events

Introduced

Fixed

5dd435c489456ff52003a4c2eca836af09ae9dfe

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.5-alpha-patch"
        }
    ]
}

Affected versions

Other

published

v1.*

v1.1.0-alpha

v1.2.0-alpha

v1.2.1-alpha-patch

v1.2.2-alpha-patch

v1.2.3-alpha-patch

v1.2.4-alpha-patch