High 8.8Published Oct 16, 2025

CVE-2025-62428Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints

Updated under an hour ago (Oct 28, 2026, 5:00 AM ET)

Does this affect you?

It affects Drawing-Captcha-APP. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Drawing-Captcha-APP

Exploited in the last 30 days

Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links. These links can redirect users to attacker-controlled domains. This vulnerability affects all users relying on email confirmation for account registration or verification. This vulnerability is fixed in 1.2.5-alpha-patch.

CVSS: 8.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 17, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Drawing-Captcha Drawing-Captcha-APP drawing_captcha:app (from the name)	before 1.2.5-alpha-patch	CNA record

References

References

https://github.com/Drawing-Captcha/Drawing-Captcha-APP/security/advisories/GHSA-5pj8-fc6g-vv7m	x-refsource-confirm
https://github.com/Drawing-Captcha/Drawing-Captcha-APP/issues/30	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.