Login Request a demo
Critical severity · published Feb 19, 2026
CVE-2025-8350
Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
BiEticaret CMS · Inrove Software and Internet Services
2.1.13 through 19022026 · source: vendor
Affected product
BC
BiEticaret CMS
Inrove Software and Internet Services
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8350
siberguvenlik.gov.tr
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0077
www.usom.gov.tr
https://www.usom.gov.tr/bildirim/tr-26-0077