CVE-2025-13033

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-130345.9When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the serCVE-2025-130358.0The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the pCVE-2025-130369.2An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoCVE-2025-13048.8The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_andCVE-2025-130428.8Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruptionCVE-2025-130446.2IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a CVE-2025-130486.4The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in CVE-2025-13058.8The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due tCVE-2025-130519.3When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL witCVE-2025-130525.9When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows aCVE-2025-130533.7When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker CVE-2025-130546.4The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored
CVE-2025-13033: High severity, CVSS 7.5 | Vulnix