CVE-2024-26470

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request...

CVE-2024-26470

The FullStackHero.WebAPI.Boilerplate .NET 8 webapi starter kit (v1.0.0 and v1.0.1) is vulnerable to HTTP Header Injection due to insufficient input validation in the forgotten password functionality. An attacker can manipulate the Host header to leak sensitive password reset tokens by convincing ...