CVE-2020-18984

A reflected cross-site scripting XSS vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2018-25016

Greenbone Security Assistant GSA before 7.0.3 and Greenbone OS GOS before 5.0.0 allow Host Header Injection...

CVE-2019-13285

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

CVE-2019-6146

It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...

CVE-2025-40631

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631 HTTP host header injection vulnerability in IceWarp Mail Server

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631

CVE-2025-40631 describes an HTTP Host header injection affecting IceWarp Mail Server, version 11.4.0. By modifying the Host header and delivering a payload, arbitrary JavaScript can be executed on the loaded page when a user interacts with a malicious link (redirect). The vulnerability is tied to...

IceWarp Mail Server 安全漏洞

IceWarp Mail Server is a mail server product from the Czech company IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A security vulnerability exists in IceWarp Mail Server version 11.4.0, which originates from HTTP host header injection and cou...

PT-2025-21634 · Icewarp · Icewarp Mail Server

Name of the Vulnerable Software and Affected Versions: Icwarp Mail Server version 11.4.0 Description: The issue allows for HTTP host header injection, enabling the execution of arbitrary JavaScript code on page load when a user interacts with a malicious link. This is achieved by modifying the Ho...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

Retool 安全漏洞

Retool is a platform from Retool, Inc. Any content can be developed using the code, design, debug, review, and deploy features. A security vulnerability exists in Retool versions prior to 3.196.0 that stems from host header injection allowed when the BASEDOMAIN environment variable is not set...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

CVE-2025-47424

CVE-2025-47424 affects Retool (self-hosted) prior to 3.196.0. The underlying issue is a Host header injection when BASE_DOMAIN is not set, allowing manipulation of the HTTP Host header. The vulnerability is described with a potential impact on confidentiality/integrity (per the CVSS metrics) and ...

CVE-2025-47424

Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...

PT-2025-20603 · Retool · Retool

Name of the Vulnerable Software and Affected Versions: Retool self-hosted versions prior to 3.196.0 Description: The issue allows for Host header injection when the BASE DOMAIN environment variable is not set, enabling manipulation of the HTTP host header. Recommendations: For versions prior to...