{"id":"CVE-2025-63314","title":"A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.","summary":"A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","cwe":["CWE-640"],"vendor":"ddsn","product":"cm3_acora_cms","affected":["cm3_acora_cms = 10.7.1"],"published":"2026-01-12","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-63314","references":[{"url":"https://github.com/padayali-JD/CVE-2025-63314","label":"cve@mitre.org"}],"tags":["nvd","exploit-available"],"epss":0.00291,"epssPercentile":0.19247,"ingestedAt":"2026-07-06T16:44:34.502Z","exploits":{"github":1,"githubRepos":["https://github.com/padayali-JD/CVE-2025-63314"],"checkedAt":"2026-09-25T08:20:48.240Z"},"exploitAvailable":true,"slug":"CVE-2025-63314","body":"## Overview\n\nA static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.\n\n## Affected\n\n- `cm3_acora_cms = 10.7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4894,"id":"CVE-2025-63314","ts":1788887215228,"field":"exploit_available","old":"false","new":"true"},{"seq":3777,"id":"CVE-2025-63314","ts":1788886334789,"field":"exploit_available","old":"true","new":"false"},{"seq":2622,"id":"CVE-2025-63314","ts":1788883013029,"field":"exploit_available","old":"false","new":"true"},{"seq":1651,"id":"CVE-2025-63314","ts":1788882417377,"field":"exploit_available","old":"true","new":"false"},{"seq":759,"id":"CVE-2025-63314","ts":1788881850681,"field":"exploit_available","old":"false","new":"true"}]}