CVE-2025-49029

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

2.20% chance of exploitation in the next 30 days, 81th percentile

Nuclei

high

Published

2025-07-01

Updated

2026-04-28

Proof-of-concept exploits (1)

• Nxploited/CVE-2025-490292★ · 2025-07-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49029.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-4902
• CVE-2025-4903
• CVE-2025-4901
• CVE-2025-4904
• CVE-2025-49003
• CVE-2025-4905