CVE-2025-48445

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Drupal	Commerce Eurobank (Redirect)	>= 0.0.0, < 2.1.1

References

https://www.drupal.org/sa-contrib-2025-066Vendor Advisory

Timeline

Published: Jun 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484468.8Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphaban CVE-2025-484477.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site CVE-2025-484486.5Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affect CVE-2025-48459.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functi CVE-2025-484595.3Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recom CVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUT CVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as CVE-2025-484624.2Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from loggi CVE-2025-484633.1Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as CVE-2025-484644.7Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as CVE-2025-484668.1Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digita CVE-2025-484676.5Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-serv