affected:
- package:
    ecosystem: PyPI
    name: taguette
    purl: pkg:pypi/taguette
  ranges:
  - events:
    - introduced: '0'
    - fixed: 1.5.1
    type: ECOSYSTEM
  versions:
  - '0.0'
  - 0.0.1
  - '0.1'
  - '0.10'
  - 0.10.1
  - '0.11'
  - '0.2'
  - '0.3'
  - '0.4'
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.4.4
  - 0.5.post1
  - '0.6'
  - '0.7'
  - '0.8'
  - '0.9'
  - 0.9.1
  - 0.9.2
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.1.1
  - 1.2.0
  - 1.3.0
  - 1.4.1
  - 1.5.0
aliases:
- CVE-2025-62527
- GHSA-7rc8-5c8q-jr6j
details: Taguette is an open source qualitative research tool. An issue has been discovered
  in Taguette versions prior to 1.5.0. It was possible for an attacker to request
  password reset email containing a malicious link, allowing the attacker to set the
  email if clicked by the victim. This issue has been patched in version 1.5.0.
id: PYSEC-2025-187
modified: '2026-05-20T09:19:18.035895Z'
published: '2025-10-20T20:15:37.573Z'
references:
- type: REPORT
  url: https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6j
- type: REPORT
  url: https://gitlab.com/remram44/taguette/-/issues/331
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
  type: CVSS_V3