CVE-2025-8350 | Execution After Redirect (EAR), Missing Authentication for C… | CVSS 9.8 CRITICAL

Description

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metadata

CVE ID: CVE-2025-8350
State: PUBLISHED
Assigner: TR-CERT
Reserved: 2025-07-30 11:43 UTC
Published: 2026-02-19 11:30 UTC
Last updated: 2026-06-05 11:37 UTC
Primary CWE: CWE-698
CWE-698 Execution After Redirect (EAR)
Vendor / Product: Inrove Software and Internet Services / BiEticaret CMS
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Inrove Software and Internet Services	BiEticaret CMS	—	2.1.13 ≤ 19022026

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306 Missing Authentication for Critical Function
CWE-698	cna	CWE-698 Execution After Redirect (EAR)

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)