3734 matches found
CVE-2025-62406
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's...
CVE-2025-62406
Summary: CVE-2025-62406 affects Piwigo. In version 15.6.0, the password-reset URL is constructed using the request Host header without validation, allowing an attacker who knows or guesses a username/email to send a password-reset link with a modified hostname to a target user. This could enable ...
CVE-2025-62406 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's...
CVE-2025-62406 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's...
HTTP Header Injection
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to HTTP Header Injection via manipulation of the Host header in password reset requests. An attacker can cause users to be redirected to malicious...
GHSA-FFPG-GM3H-4P5P Backdrop CMS Host Header Injection vulnerability
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
Backdrop CMS Host Header Injection vulnerability
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
PT-2025-47413
Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 15.7.0 Description Piwigo is a photo gallery application for the web. The password reset function in versions prior to 15.7.0 does not validate the hostname used in the password-reset URL, which is taken directly from...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
Mozilla Firefox < 63.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 63.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-26 advisory. - When manipulating user events in nested loops while opening a document through script, it is possible to...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
PT-2025-47370
Name of the Vulnerable Software and Affected Versions Backdrop CMS version 1.32.1 Description A Host Header Injection flaw exists in Backdrop CMS. This issue allows attackers to manipulate the Host header within password reset requests. Successful exploitation can lead to redirection to malicious...
Backdrop CMS 安全漏洞
Backdrop CMS is a content management system CMS from Backdrop CMS open source. A security vulnerability exists in Backdrop CMS version 1.32.1 that stems from improper manipulation of the Host header in a password reset request, which could lead to redirection to a malicious domain and session...
CVE-2025-63828
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection...
CVE-2025-63828
CVE-2025-63828 is a host header injection vulnerability in Backdrop CMS 1.32.1. The issue arises from manipulation of the Host header during password reset requests, which can cause redirects to malicious domains and may enable session hijacking via cookie injection. Documents consistently descri...
Piwigo 授权问题漏洞
Piwigo is Piwigo open source a set of Web-based open source image library software. The software includes features such as image management, image categorization and permission management. An authorization issue vulnerability exists in Piwigo version 15.6.0, which stems from the password reset...
CVE-2025-36223
IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...
ROS-20251113-02
The Webmin hosting control panel vulnerability involves manipulating the Host header to inject a malicious domain into a password reset email. malicious domain in a password reset link email. Exploitation of the vulnerability could allow an attacker acting remotely to intercept the password reset...
CVE-2025-36223
IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...