CVE-2025-43933: External Control of Assumed-Immutable Web Parameter

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

PT-2025-28176 · Fblog · Fblog

Name of the Vulnerable Software and Affected Versions: fblog versions through 983bede Description: The issue allows account takeover via the password reset feature because the SERVER NAME is not configured, causing the reset to depend on the Host HTTP header. Recommendations: For versions through...