{"id":"EUVD-2025-203823","revision":"ddff611dbfa644749dd5b4646809099d","records":[{"revision":"ddff611dbfa644749dd5b4646809099d","observedAt":"2026-10-30T00:58:15.735+00:00","statement":{"source":"euvd","id":"EUVD-2025-203823","aliases":["CVE-2025-65581","GHSA-vfm5-cr22-jg3m"],"title":"An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary exte…","description":"An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1","https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203823","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 16, 2025, 12:00:00 AM","dateUpdated":"Dec 16, 2025, 7:14:01 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203823","identifiers":["EUVD-2025-203823","CVE-2025-65581","GHSA-vfm5-cr22-jg3m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}