CVE-2025-23001

A Host header injection vulnerability exists in CTFd version 3.7.5 because the application fails to properly validate or sanitize the Host header. An attacker can manipulate this header in HTTP requests to potentially facilitate phishing attacks , password resets , or cache poisoning . To mitigat...