CVE-2025-62527

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-62527

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62527.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-62527

Aliases

Published

2025-10-20T20:03:29.405Z

Modified

2026-05-20T08:11:10.517813393Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Taguette vulnerable to password reset link poisoning

Details

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62527.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-15"
    ]
}

References

Affected packages

Git / github.com/remram44/taguette

Affected ranges

Type: GIT
Repo: https://github.com/remram44/taguette
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d6e5238c09faa4a9a00a78c1dcdb9a4ba9a22cbd

Affected versions

v0.*

v0.0

v0.1

v0.10

v0.11

v0.2

v0.3

v0.4

v0.4.1

v0.4.2

v0.4.3

v0.5

v0.5-alpha.0

v0.6

v0.7

v0.8

v0.9

v0.9.1

v0.9.2

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.2.0

v1.3.0

v1.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62527.json"