CVE-2025-61136

The software axewater sharewarez version 2.4.3 contains a Host Header Injection vulnerability within its password reset component. The root cause is the use of Flask's url_for(_external=True) to generate reset links without a fixed SERVER_NAME, allowing remote attackers to manipulate the Host hea...