PT-2025-42805 · Taguette · Taguette

Published 2025-10-20 · Updated 2025-10-22 · CVE-2025-62527

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Taguette versions prior to 1.5.0

Description An issue exists that allows an attacker to request a password reset email containing a malicious link. If a victim clicks the link, the attacker can set the email address. The affected API endpoint is the password reset functionality. The vulnerable parameter is the email address used in the password reset request.

Recommendations Upgrade to Taguette version 1.5.0.

Exploit

Fix

Weakness Enumeration

CWE-15

Related Identifiers

CVE-2025-62527

GHSA-7RC8-5C8Q-JR6J

PYSEC-2025-187

Affected Products

Taguette

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62527.json · Exploit
• https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62527 · Security Note
• https://gitlab.com/remram44/taguette/-/issues/331 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62527 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rc8-5c8q-jr6j · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-187 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/taguette/PYSEC-2025-187.yaml · Note
• https://github.com/remram44/taguette · Note
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1980388606767239394 · Twitter Post
• https://t.me/CVEtracker/35349 · Telegram Post
• https://twitter.com/CVEnew/status/1980367939862949984 · Twitter Post