CVE-2025-0423: Cordaware Bestinformed Web

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.

Affected products

• Cordaware Bestinformed Web: before 6.2.2.5 (fixed in 6.2.2.5)

Published 2025-02-18. Last modified 2026-06-17.