CVE-2025-52560 Kanboard Password Reset Poisoning via Host Header Injection

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the applicationurl configuration is unset default behavior. This allows an attacker to...

CVE-2025-52560 Kanboard Password Reset Poisoning via Host Header Injection

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the applicationurl configuration is unset default behavior. This allows an attacker to...

CVE-2025-52560

Kanboard vulnerability CVE-2025-52560 affects Kanboard prior to version 1.2.46 where password reset emails can include URLs derived from an unvalidated Host header if application_url is unset. An attacker can craft a malicious password reset link that leaks the reset token to a domain they contro...

GHSA-VRW8-FXC6-2R93 chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Summary The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect. We consider this a lower-severity open redirect, as it can't be exploited from browsers or email clients requires manipulation of a Host header. Details The...

chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Summary The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect. We consider this a lower-severity open redirect, as it can't be exploited from browsers or email clients requires manipulation of a Host header. Details The...

CVE-2024-46452

A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL...

CVE-2024-46452

A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL...

PT-2025-24540 · Unknown · Vigybag Open Source Online Shop

Name of the Vulnerable Software and Affected Versions: VigyBag Open Source Online Shop affected versions not specified Description: A Host Header injection issue in the password reset function allows attackers to redirect victim users to a malicious site via a crafted URL. Recommendations: At the...

CVE-2024-46452

A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL...

CVE-2024-46452

The CVE-2024-46452 entry concerns VigyBag Open Source Online Shop. A Host Header injection vulnerability exists in the password reset function, tied to commit 3f0e21b, enabling attackers to cause victims to be redirected to a malicious site via a crafted URL. The available sources describe the vu...

CVE-2024-46452

A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL...

VigyBag Open Source Online Shop 安全漏洞

VigyBag Open Source Online Shop is an open source e-commerce platform from VigyBag India. A security vulnerability exists in VigyBag Open Source Online Shop that stems from a Host Header injection in the password reset function, which could result in a redirection to a malicious site...

CVE-2024-42903

A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain...

CVE-2024-26470

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request...

CVE-2024-51329

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42915

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts...

CVE-2024-45981

A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...

CVE-2024-45980

A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...

CVE-2024-45979

A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...