CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2025-0178 WatchGaurd Firebox Host Header Injection Vulnerability

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, o...

CVE-2025-0178 WatchGaurd Firebox Host Header Injection Vulnerability

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, o...

SUSE CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

CVE-2024-57177

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CVE-2024-57177

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

PT-2025-6098 · Perfood · Couch-Auth

Name of the Vulnerable Software and Affected Versions: perfood/couch-auth versions = 0.21.2 Description: A host header injection vulnerability exists in the NPM package of perfood/couch-auth. By sending a specially crafted host header in the email change confirmation request, it is possible to...

CVE-2024-57177

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CVE-2024-57177

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CouchAuth 注入漏洞

CouchAuth is a Perfood open source authentication API. An injection vulnerability exists in CouchAuth 0.21.2 and earlier versions, which stems from the presence of host header injection in NPM packages, allowing an attacker to trigger an SSTI via a specially crafted request to disclose informatio...

CVE-2024-54840

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection...

CVE-2022-0935

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

CVE-2024-25625

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in pimcore/admin-ui-classic-bundle prior to version 1.3.4. The vulnerability involves a Host Header Injection in the invitationLinkAction function of the UserController,...

CVE-2024-1064

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service DoS condition via a modified host header...

CVE-2024-54840

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection...

CVE-2024-54840

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection...

PT-2025-3075 · Cyberark · Cyberark Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4 Description: The issue arises from inadequate handling of environment problems that can lead to Host header injection. This can potentially allow attackers to manipulate th...

CyberArk Privileged Access Manager Self-Hosted 安全漏洞

CyberArk Privileged Access Manager Self-Hosted is a privileged access self-hosted manager from CyberArk, Israel. A security vulnerability exists in CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4, which stems from an environmental issue where password vault Web access is not...

CVE-2024-54840

CVE-2024-54840 describes a vulnerability in CyberArk Privileged Access Manager Self-Hosted PVWA before 14.4, where environment handling can lead to Host header injection. The issue arises from how PVWA resolves environment context, enabling manipulation of the HTTP Host header in affected deploym...