What is the CVSS score of EUVD-2025-20280?

EUVD-2025-20280 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

Which versions of Natours are affected by EUVD-2025-20280?

CVE-2025-53373 is a high-severity vulnerability (CVSS 8.9) affecting Natours that requires immediate patching to prevent potential compromise of application integrity and availability.. A patch is available.

How to fix or mitigate EUVD-2025-20280?

Within 24 hours: Identify all systems running Natours and document current versions. Within 7 days: Apply the vendor-released patch to all affected Natours instances in non-production environments and validate functionality. Within 30 days: Deploy patched version to all production Natours systems with change management approval and post-patch verification.

Natours EUVD-2025-20280

| CVE-2025-53373 HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2025-07-07 security-advisories@github.com

Code Injection

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:34 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7401793a8d9ed0f0c250c4e0ee2815d685d7a70b

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20280

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 16:15 nvd

HIGH 8.9

DescriptionGitHub Advisory

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.