3856 matches found
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
CVE-2025-61536
FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-22381
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-22381
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...
CVE-2025-61536
FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
CraftMyCMS 安全漏洞
CraftMyCMS is a content management system by Kévin GUIOT Individual Developer. A security vulnerability exists in CraftMyCMS version 4.0.2, which stems from the password reset feature constructing a reset link directly using the HTTPHOST header, which could lead to a phishing attack or account...
CVE-2025-61536
FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...
CVE-2025-61543
CraftMyCMS 4.0.2.2 is affected by a Host Header Injection vulnerability in its password reset flow. The application uses $_SERVER['HTTP_HOST'] to construct reset links, allowing an attacker to alter the Host header and send malicious reset URLs, enabling phishing or potential account takeover. Th...
CVE-2025-61536
FelixRiddle dev-jobs-handlebars 1.0 is affected by CVE-2025-61536. The issue arises from generating absolute password-reset (magic) links using the untrusted req.headers.host header and forcing the http:// scheme. This allows an attacker who can control the Host header (or a misconfigured proxy/l...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-61543
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...
PT-2025-42471
Name of the Vulnerable Software and Affected Versions Aggie version 2.6.1 Description A Host Header injection flaw exists in the forgot password functionality of the software. This allows an attacker to reset a user's password. The vulnerability is present in the handling of the Host header durin...
Drawing-Captcha APP 输入验证错误漏洞
Drawing-Captcha APP is a captcha application from Drawing Captcha open source. An input validation error vulnerability exists in Drawing-Captcha APP that stems from the presence of host header injection in the /register and /confirm-email endpoints, which could result in users being redirected to...
Aggie 安全漏洞
aggie is Technology & International Development Lab's open source software for tracking events around real-time events such as elections or natural disasters using social media and other sources. Aggie version 2.6.1 has a security vulnerability that stems from a host header injection in the Forgo...
CVE-2025-22381
Aggie 2.6.1 is affected by CVE-2025-22381 via a Host Header injection in the forgot password flow. The vulnerability allows a attacker to reset a user’s password, with PoC/exploit guidance published in PacketStorm for CVE-2025-22381. Affected versions include 2.6.1 and earlier; as of February 202...
CVE-2025-61541
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...
CVE-2025-61541
Webmin 2.510 is affected by CVE-2025-61541 due to a Host Header Injection in forgot_send.cgi. The reset link is constructed using the HTTP Host header via get_webmin_email_url(), allowing an attacker to inject a malicious domain into the password reset email. If a victim clicks the poisoned link,...