CVE-2025-4296

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.

This issue affects B2B: before 04.06.2025.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
HotelRunnerB2B< 04.06.2025

References

Timeline

Published
Jul 23, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429604.3SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting iCVE-2025-429614.9Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit CVE-2025-429626.1SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, CVE-2025-429639.1A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafeCVE-2025-429649.1SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deCVE-2025-429654.1SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during joCVE-2025-429669.1SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deseriaCVE-2025-429679.9SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privilegCVE-2025-429684.3SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-seCVE-2025-429696.1SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically cCVE-2025-42979.8A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part ofCVE-2025-429705.8SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive