CVE-2025-61136

A Host Header Injection vulnerability exists in the password reset component of axewater sharewarez v2.4.3 . The root cause is the use of Flask's url_for(_external=True) to generate reset links without a fixed SERVER_NAME , allowing remote attackers to manipulate the Host header . This can lead t...