CVE-2025-63314: Ddsn CM3 Acora CMS

Critical severity, CVSS 10.0. EPSS: 0.3% chance of exploitation in the next 30 days.

A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

Affected products

• Ddsn CM3 Acora CMS: version 10.7.1 only

Published 2026-01-12. Last modified 2026-07-05.