5 matches found
CVE-2024-29643
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...
croogo Host header injection
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...
CVE-2024-29643
The croogo v.3.0.2 CMS is vulnerable to Host header injection via its feed.rss component. The flaw occurs because the component takes the content of the -H argument from a request and passes it into the element of a response without proper filtering. An attacker can exploit this to redirect user...
PT-2025-17297 · Croogo · Croogo
Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...
