4893 matches found
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
CVE-2025-22381
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-62428
Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation...
CVE-2025-62428 Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints
Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation...
CVE-2025-62428 Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints
Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation...
CVE-2025-62428 Drawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints
Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation...
CVE-2025-62428
CVE-2025-62428 affects Drawing-Captcha APP. A Host Header Injection vulnerability exists in /register and /confirm-email endpoints, allowing an attacker to manipulate the Host header and generate malicious email confirmation links that redirect users to attacker-controlled domains. Impact concern...
EUVD-2025-34767
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
EUVD-2025-34759
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-22381
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
CVE-2025-22381
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-61543
CraftMyCMS 4.0.2.2 is affected by a Host Header Injection vulnerability in its password reset flow. The application uses $_SERVER['HTTP_HOST'] to construct reset links, allowing an attacker to alter the Host header and send malicious reset URLs, enabling phishing or potential account takeover. Th...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
Drawing-Captcha APP 输入验证错误漏洞
Drawing-Captcha APP is a captcha application from Drawing Captcha open source. An input validation error vulnerability exists in Drawing-Captcha APP that stems from the presence of host header injection in the /register and /confirm-email endpoints, which could result in users being redirected to...
PT-2025-42471
Name of the Vulnerable Software and Affected Versions Aggie version 2.6.1 Description A Host Header injection flaw exists in the forgot password functionality of the software. This allows an attacker to reset a user's password. The vulnerability is present in the handling of the Host header durin...
CVE-2025-22381
Aggie 2.6.1 is affected by CVE-2025-22381 via a Host Header injection in the forgot password flow. The vulnerability allows a attacker to reset a user’s password, with PoC/exploit guidance published in PacketStorm for CVE-2025-22381. Affected versions include 2.6.1 and earlier; as of February 202...
CVE-2025-61541
Webmin 2.510 is affected by CVE-2025-61541 due to a Host Header Injection in forgot_send.cgi. The reset link is constructed using the HTTP Host header via get_webmin_email_url(), allowing an attacker to inject a malicious domain into the password reset email. If a victim clicks the poisoned link,...