PT-2025-42541 · Unknown · Drawing-Captcha-App

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-62428

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Drawing-Captcha APP versions prior to 1.2.5-alpha-patch

Description Drawing-Captcha APP is susceptible to a Host Header Injection affecting the /register and /confirm-email API endpoints. An attacker can manipulate the Host header in HTTP requests to create malicious email confirmation links. These links can redirect users to domains controlled by the attacker. This impacts all users who depend on email confirmation for account registration or verification. The vulnerable parameters are the Host header in HTTP requests.

Recommendations Update to version 1.2.5-alpha-patch or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-62428

GHSA-5PJ8-FC6G-VV7M

Affected Products

Drawing-Captcha-App

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62428.json · Exploit
• 🔥 https://github.com/Drawing-Captcha/Drawing-Captcha-APP/issues/30 · Exploit
• https://osv.dev/vulnerability/CVE-2025-62428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62428 · Security Note
• https://github.com/Drawing-Captcha/Drawing-Captcha-APP/security/advisories/GHSA-5pj8-fc6g-vv7m · Note
• https://twitter.com/CVEnew/status/1978926546363597018 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978941315514573046 · Twitter Post
• https://t.me/CVEtracker/35154 · Telegram Post