KodExplorer CVE-2025-34504

Exploitation targets the KodExplorer user login endpoint and requires the attacker to supply an arbitrary external URL in the 'link' parameter of the login request; the application fails to validate/whitelist this redirect target. The key limiting factor is required user interaction (CVSS UI:P): a victim must open the attacker-crafted link and proceed through login, so this cannot be exploited silently or server-side - it depends on successful social engineering. No authentication is required of the attacker to craft the link (PR:N), and it works against default configurations of KodExplorer 4.52, but impact is confined to redirecting the victim's browser (credential phishing / trust abuse), not direct server compromise.

This is a genuinely low-to-moderate severity issue, and the multiple signals largely agree rather than conflict. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L/VA:N, no subsequent-system impact) correctly characterizes an open redirect (CWE-601): network-reachable and unauthenticated to trigger, but requiring victim interaction (UI:P) - a user must click or follow the attacker-crafted link - and yielding only limited confidentiality/integrity impact (credential phishing or trust abuse), with no availability impact. EPSS is low at 0.32% (23rd percentile), which is consistent with the class: open redirects are rarely mass-exploited by automated scanners because they depend on social-engineering a human. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. However, public exploit code DOES exist (Exploit-DB 52245), so the technical barrier to abuse is effectively zero. Net assessment: this is a real but secondary-priority issue - the CVSS 5.3 / low EPSS / no-KEV combination points to a credible phishing-enablement weakness rather than a server-compromise emergency. It should be patched in the normal cycle, prioritized higher only where KodExplorer is internet-facing and used for authentication flows that users trust.

An attacker crafts a KodExplorer login URL with a malicious value in the 'link' parameter pointing to an attacker-controlled site, then distributes it via email or chat. Because the URL legitimately originates on the trusted KodExplorer host, the victim trusts it, logs in, and is then silently redirected to a lookalike phishing page to harvest credentials or deliver malware. Public exploit code for this exact flow is available on Exploit-DB (52245), lowering the effort required.