CVE-2025-61541

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

PT-2025-42471

Name of the Vulnerable Software and Affected Versions Aggie version 2.6.1 Description A Host Header injection flaw exists in the forgot password functionality of the software. This allows an attacker to reset a user's password. The vulnerability is present in the handling of the Host header durin...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-61541

Webmin 2.510 is affected by CVE-2025-61541 due to a Host Header Injection in forgot_send.cgi. The reset link is constructed using the HTTP Host header via get_webmin_email_url(), allowing an attacker to inject a malicious domain into the password reset email. If a victim clicks the poisoned link,...

Webmin 安全漏洞

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.510, which stems from an unvalidated HTTP Host header in the password reset function, which could allow an attacker to...

CVE-2025-22381

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

Dev jobs handlebars 安全漏洞

Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...

arkadiyt-projects: DNS Rebinding Attack

Hi, there is a DNS rebinding vulnerability in your SSRF filter. F4891755 You validate the hostname's IP address, but then pass the hostname to Net::HTTP.start, which does its own DNS lookup. An attacker can control a DNS server that returns a safe public IP during validation, then returns 127.0.0...

Exploit for Open Redirect in Mailcow Mailcow\:_Dockerized

CVE-2024-25198 mailcow: dockerized is an open source groupwar...

CVE-2025-52647

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks...

EUVD-2025-33794

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks...

PT-2025-42477

Name of the Vulnerable Software and Affected Versions Webmin version 2.510 Description Webmin version 2.510 has a flaw in the password reset functionality forgot send.cgi. The reset link sent to users is created using the HTTP Host header through the get webmin email url function. An attacker can...

Astro's `X-Forwarded-Host` is reflected without validation

Summary When running Astro in on-demand rendering mode using a adapter such as the node adapter it is possible to maliciously send an X-Forwarded-Host header that is reflected when using the recommended Astro.url property as there is no validation that the value is safe. Details Astro reflects th...

CVE-2025-52647

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks...

CVE-2025-52647

CVE-2025-52647 affects HCL BigFix WebUI and is described as a host header poisoning vulnerability where the application responds with HOST information from HTTP header fields. Connected sources consistently reference this issue in BigFix WebUI across multiple ecosystems (Red Hat, CNVD, NVD, CVE l...

CVE-2025-52647 HCL BigFix WebUI is affected by a host header poisoning vulnerability

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks...

CVE-2025-52647 HCL BigFix WebUI is affected by a host header poisoning vulnerability

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks...

BIT-EJBCA-2025-3026 Improper Neutralization of Special Elements vulnerability in EJBCA

The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his...

PT-2025-41598

Name of the Vulnerable Software and Affected Versions Astro versions prior to 5.14.2 Description Astro, a web framework, does not validate the X-Forwarded-Host header when using Astro.url, leading to potential manipulation of output values. A malicious request with a differing Host and...

HCL BigFix WebUI 安全漏洞

HCL BigFix WebUI is a web based administration page of HCL India. A security vulnerability exists in HCL BigFix WebUI, which stems from an improper response to the HOST information in the HTTP header field, and can be exploited by an attacker to cause a host header poisoning attack...