CVE-2025-50578

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading...

CVE-2025-50578

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading...

CVE-2025-50578

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading...

PT-2025-31395

Name of the Vulnerable Software and Affected Versions heimdall version 2.6.3-ls307 Description The application does not properly validate user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. This allows for Host Header Injection and Open Redirect attacks. An unauthenticated remo...

Heimdall 安全漏洞

Heimdall is an open source application panel and launcher for LinuxServer.io. A security vulnerability exists in Heimdall version 2.6.3-ls307, which stems from improper HTTP header handling and could lead to host header injection and open redirection attacks...

CVE-2025-50578

Heimdall 2.6.3-ls307 (LinuxServer.io) contains a vulnerability in handling user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirects, enabling loading of external resou...

CVE-2025-50578

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading...

CVE-2024-40686 IBM SmartCloud Analytics - Log Analysis HOST header injection

IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including...

CVE-2024-40686

The CVE-2024-40686 issue affects IBM SmartCloud Analytics - Log Analysis versions 1.3.7.0 through 1.3.8.2. Root cause: improper validation of input in the HOST header, enabling HTTP header injection. Consequences stated in the sources include potential cross-site scripting, cache poisoning, or se...

CVE-2025-4295 Host Header Injection in HotelRunner's B2B

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...

CVE-2025-4295 Host Header Injection in HotelRunner's B2B

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...

CVE-2025-4295

HotelRunner B2B is affected by CVE-2025-4295 due to improper validation of TLS certificates with host mismatches, enabling HTTP response splitting. The issue impacts HotelRunner B2B versions prior to 04.06.2025. Root cause and affected component: certificate host name validation flaw in the B2B p...

GO-2025-3770 Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi

Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi...

CVE-2025-53373

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373

Natours (Tour Booking API) has a Host header injection vulnerability in the /forgetpassword endpoint that lets an attacker take over a victim's account by supplying an attacker-controlled server domain. The issue is mitigated by the fix in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b. Affected...

CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

Natours 授权问题漏洞

Natours is a travel booking API by Ahmed Emad Personal Developer. Natours suffers from an authorization issue vulnerability that stems from Host header injection, which could lead to account takeover...