Medium severity · published Dec 11, 2025
CVE-2025-34504
KodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft malicious URLs in the link parameter to redirect users to arbitrary external websites after authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
KodExplorer · kodcloud
4.52 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34504
Release Notes
https://github.com/kalcaddle/KodExplorer/releases/tag/4.52
Product
https://kodcloud.com/
Exploit
https://www.exploit-db.com/exploits/52245
Third Party Advisory
https://www.vulncheck.com/advisories/kodexplorer-open-redirect-vulnerability-via-user-login-endpoint
More from KodExplorer
9.8
CVE-2023-6853
kalcaddle KodExplorer app.php index server-side request forgery
9.8
CVE-2023-6852
kalcaddle KodExplorer app.php server-side request forgery
9.8
CVE-2023-6851
kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
9.8
CVE-2023-6850
kalcaddle KodExplorer API Endpoint unrestricted upload
8.8
CVE-2022-4944
kalcaddle KodExplorer cross-site request forgery