What is the CVSS score of CVE-2025-53821?

CVE-2025-53821 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-53821?

Organizations using the web application should be aware of moderate risk from CVE-2025-53821 rated CVSS 4.7. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-53821?

Yes, a public proof-of-concept exploit is available for CVE-2025-53821. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-53821?

Within 30 days: Identify affected systems running the web application and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2025-53821

EUVD-2025-21395 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2025-07-14 security-advisories@github.com

PHP Open Redirect Wegia

4.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.4.5

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21395

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 18, 2025 - 20:08 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 23:15 nvd

MEDIUM 4.7

DescriptionGitHub Advisory

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the nextPage parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix for the issue.

Analysis

Technical ContextAI

An open redirect vulnerability allows attackers to redirect users from a trusted domain to an arbitrary external URL through manipulation of redirect parameters. This vulnerability is classified as URL Redirection to Untrusted Site (Open Redirect) (CWE-601).

RemediationAI

Validate redirect URLs against a whitelist of allowed destinations. Use relative URLs for redirects. Warn users before redirecting to external sites.

More in PHP

View all

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2018-11138 CRITICAL Emergency POC

9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2025-53821 vulnerability details – vuln.today

Back

PHP CVE-2025-53821

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

More in PHP

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

Share

External POC / Exploit Code