What is the CVSS score of CVE-2025-1885?

CVE-2025-1885 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Open Redirect are affected by CVE-2025-1885?

CVE-2025-1885 presents moderate security risk rated CVSS 5.4. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-1885?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Open Redirect CVE-2025-1885

MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2025-12-19 iletisim@usom.gov.tr

Open Redirect

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 08:22 vuln.today

CVE Published

Dec 19, 2025 - 12:15 nvd

MEDIUM 5.4

DescriptionCVE.org

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forceful Browsing.This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Restajet Online Food Delivery System allows authenticated users to redirect victims to untrusted external sites through an unvalidated URL redirection mechanism, enabling phishing attacks and forceful browsing. The vulnerability affects all versions through 19122025 and has a moderate CVSS score of 5.4 with low exploitation probability (EPSS 0.04%, 12th percentile), indicating limited real-world attack likelihood despite the functional impact. The vendor has not responded to early disclosure attempts by the Turkish national CERT, leaving no official patch available.

Technical ContextAI

This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site), a client-side control mechanism flaw where user-supplied input is used to construct redirect URLs without proper validation or whitelisting. The affected product is Restajet Online Food Delivery System (CPE: cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*), which implements web-based food delivery functionality. The attack vector is network-based and requires low attack complexity, but mandates authenticated user privileges (PR:L per CVSS vector), meaning a logged-in user or attacker with valid credentials can craft malicious redirect parameters. The vulnerability allows scope changes (S:C), meaning the impact can cross security boundaries in the application context, affecting other users or systems downstream of the redirect.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations should contact Restajet Information Technologies Inc. directly to request a security update and establish a timeline for patching. As a temporary mitigation, implement strict URL validation and whitelisting on all redirect parameters, enforce a Content Security Policy (CSP) with frame-ancestors and redirect-uri directives to restrict outbound redirects, and consider implementing a redirect interstitial page that warns users before following external links. Additionally, audit application logs for suspicious redirect parameter usage and restrict authenticated user accounts to trusted networks if feasible until a patch is available.

More in Open Redirect

View all

CVE-2017-1000117 HIGH Act Now POC

8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

CVE-2024-52875 HIGH Act Now POC

8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of

CVE-2016-5385 HIGH Act Now POC

8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2013-2248 MEDIUM This Month POC

5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

CVE-2012-6499 MEDIUM This Month POC

5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM This Month POC

4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

CVE-2017-3528 MEDIUM This Month POC

5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

CVE-2012-0518 MEDIUM Act Now

4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

CVE-2024-21641 MEDIUM This Month POC

6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp

CVE-2015-5354 MEDIUM This Month POC

5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM This Month POC

6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL Act Now POC

9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2025-1885 vulnerability details – vuln.today

Back