CVE-2025-63314

Critical · CVSS 10.0

DDSN Interactive Acora CMS — Static Password Reset Token / Account Takeover via Replay Attack (CWE-640)

CVSS: 10.0; nvd
EPSS: 0.26%; 18th pct
KEV: No
Class: other; CWE-640

Description

A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

Search profile — drives PoC discovery

Symbols password_reset_tokenreset_passwordpassword reset functionstatic tokenreplay attackaccount takeover

Keywords CVE-2025-63314Acora CMSDDSN Interactivestatic password reset tokenaccount takeoverreplay attackpassword reset vulnerabilityCWE-640Acora CMS 10.7.1

Versions: 10.7.1

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

padayali-JD/CVE-2025-63314 needs review

cited in references

gh_search

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

https://github.com/padayali-JD/CVE-2025-63314

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z