5 matches found
CVE-2024-29643
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...
croogo Host header injection
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...
CVE-2024-29643
The croogo v.3.0.2 CMS is vulnerable to a Host header injection attack within the feed.rss component. The root cause is that the component takes the content of the -H argument in a request and passes it through to the element in a response without proper filtering. An attacker can leverage this ...
PT-2025-17297 · Croogo · Croogo
Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...
