CVE-2016-7903

Dotclear before 2.10.3 is vulnerable to password reset address forgery because the HTTP Host header is not included in the web server routing process. This allows remote attackers to modify the password reset link. A patch is available in Dotclear 2.10.3; upgrading is recommended. (Affected: Dotc...