CVE-2025-8350
Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.55%
- CWE
- CWE-698, CWE-306
- Published
- 2026-02-19
- Last modified
- 2026-06-05
Affected products
- Inrove Software and Internet Services BiEticaret CMS
Weakness type
Related vulnerabilities
- CVE-2026-16323 — Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel
- CVE-2026-61407 — Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient...
- CVE-2026-58455 — Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
- CVE-2026-10271 — a4m4 Student-Management-System Admin Endpoint admin redirect
- CVE-2026-2699 — EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-3264 — go2ismail Free-CRM Administrative redirect
- CVE-2026-3262 — go2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirect
- CVE-2025-6967 — Authentication Bypass in Sarman Soft's CMS