Threat Intelligence Database

CVE-2025-65581 is an open redirect vulnerability in the Account module of the Volosoft ABP Framework versions 5.1.0 up to but not including 10.0.0-rc.2. The vulnerability arises from improper validation of the returnUrl parameter in the user registration function, allowing attackers to redirect users to arbitrary external domains without authorization. This flaw does not impact confidentiality or integrity directly but can be exploited to facilitate phishing or social engineering attacks by redirecting users to malicious websites. The vulnerability has a CVSS score of 5.3 (medium severity), indicating moderate risk with no authentication or user interaction required.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-65581

The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier.

CriticalVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-8070#cwe-428