CVE-2025-63563

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-286

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Stolichnayer/Summer-Pearl-Group-Insufficient-Session-ExpirationProduct

Timeline

Published: Oct 31, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-635649.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP re CVE-2025-63579.8A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. Affected is an unknown func CVE-2025-635797.5Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that en CVE-2025-63589.8A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been declared as critical. Affected by this vulnerabilit CVE-2025-635856.5OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.CVE-2025-635887.1An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and ex CVE-2025-635897.1A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encod CVE-2025-63599.8A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. Affected by this issue is some u CVE-2025-635936.1Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).CVE-2025-63609.8A vulnerability classified as critical has been found in code-projects Simple Pizza Ordering System 1.0. This affects an unknown part of the CVE-2025-636019.9Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious bac CVE-2025-636027.3A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) a