High severity8.1NVD Advisory· Published Aug 22, 2025· Updated Jun 17, 2026
CVE-2025-51605
CVE-2025-51605
Description
An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origin without any whitelist validation, while also enabling Access-Control-Allow-Credentials: true. This allows any malicious origin to make authenticated cross-origin requests and read sensitive responses.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:shopizer:shopizer:3.2.7:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:shopizer:shopizer:3.2.7:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: =3.2.7
Patches
Vulnerability mechanics
References
1- github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250512-02.mdnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.