How severe is CVE-2025-62527?

CVE-2025-62527 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2025-62527 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-62527?

CVE-2025-62527 affects Taguette. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-62527?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-62527 have an EU (EUVD) identifier?

Yes. CVE-2025-62527 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-35097.

When was CVE-2025-62527 published?

CVE-2025-62527 was published on 2025-10-20 and last updated on 2026-06-17.

CVE-2025-62527

CVE-2025-62527 is a high-severity vulnerability in Taguette with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-15.

Key facts

Severity: High (CVSS 3.x base score 7.1)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-35097
Weakness: CWE-15
Affected product: Taguette
Published: 2025-10-20
Last modified: 2026-06-17

Description

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.

Frequently asked questions

What is CVE-2025-62527?: Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
How severe is CVE-2025-62527?: CVE-2025-62527 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2025-62527 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-62527?: CVE-2025-62527 affects Taguette. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-62527?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-62527 have an EU (EUVD) identifier?: Yes. CVE-2025-62527 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-35097.
When was CVE-2025-62527 published?: CVE-2025-62527 was published on 2025-10-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:taguette:taguette:*:*:*:*:*:*:*:*

More vulnerabilities in Taguette

CVE-2025-67502 — Medium (CVSS 5.4): Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs…
CVE-2025-62528 — Medium (CVSS 5.4): Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0.…

All CVEs affecting Taguette →

Other CWE-15 vulnerabilities

CVE-2026-45087 — Critical (CVSS 10.0): Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started…
CVE-2024-4326 — Critical (CVSS 9.8): A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The…
CVE-2026-46399 — Critical (CVSS 9.4): HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0…
CVE-2024-39800 — Critical (CVSS 9.1): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of…
CVE-2024-39799 — Critical (CVSS 9.1): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of…
CVE-2024-39798 — Critical (CVSS 9.1): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of…

Browse all CWE-15 vulnerabilities →