VulnerabilityAnalyzed
CVE-2025-62527
It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim.
HIGH 7.1EPSS 0.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-15
- Affected
- taguette/taguette
- Source
- security-advisories@github.com
References
- https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6jIssue Tracking, Vendor Advisory
- https://gitlab.com/remram44/taguette/-/issues/331Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.