What is the CVSS score of CVE-2025-8350?

CVE-2025-8350 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Inrove Software are affected by CVE-2025-8350?

A critical vulnerability (CVE-2025-8350) affecting software versions 2.1.13 through 19022026 allows unauthenticated attackers to access critical functions, potentially leading to unauthorized data…

How to fix or mitigate CVE-2025-8350?

Within 24 hours: Inventory all systems running affected versions (2.1.13-19022026) and isolate them from untrusted networks if possible. Within 7 days: Implement network-level access controls (WAF rules, IP whitelisting) to restrict access to critical functions, and apply any available vendor-provided workarounds. Within 30 days: Prioritize patching immediately upon vendor release, or plan migration to unaffected versions if patches are significantly delayed.

Inrove Software CVE-2025-8350

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-19 iletisim@usom.gov.tr

Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 12:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.This issue affects BiEticaret CMS: from 2.1.13 through 19022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.