CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

CVE-2025-1680

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected...

EUVD-2025-35688

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected...

CVE-2025-1680

CVE-2025-1680 affects Moxa Ethernet switches. Description: an acceptance of extraneous untrusted data with trusted data vulnerability enables an administrator to inject crafted Host headers into HTTP requests to the device web service, classed as Host Header Injection. Root cause: improper handli...

CVE-2025-1680

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected...

CVE-2025-1680

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected...

CVE-2025-1680: Acceptance of Extraneous Untrusted Data With Trusted Data

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected...

CVE-2025-61132: Unverified Password Change

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

PT-2025-43525

Name of the Vulnerable Software and Affected Versions axewater sharewarez version 2.4.3 Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to potentially take over accounts by manipulating the Host header during passwo...

Braindump security vulnerabilities

braindump is a note-taking platform by Lev Lazinskiy Personal Developer. A security vulnerability exists in braindump version 0.4.14, which stems from a password reset component that does not properly validate the Host header, which could lead to password reset poisoning and account takeover...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

PT-2025-43519

Name of the Vulnerable Software and Affected Versions Moxa Ethernet switches affected versions not specified Description An acceptance of extraneous untrusted data with trusted data issue exists in Moxa’s Ethernet switches. This allows attackers with administrative privileges to manipulate HTTP...

CVE-2025-61136: Improper Control of Generation of Code

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

CVE-2025-61132

The note-taking platform levlaz braindump v0.4.14 contains a Host Header Injection vulnerability within its password reset component. The issue arises because Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME, allowing remote attackers to manipulate the Host header...

PT-2025-43524

Name of the Vulnerable Software and Affected Versions levlaz braindump version 0.4.14 Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to manipulate the Host header during password reset link generation, specifically...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...

Moxa Ethernet switches security vulnerabilities

Moxa Ethernet switches is an industrial grade network switch from Moxa Corporation, Taiwan, China. A security vulnerability exists in Moxa Ethernet switches that originates from HTTP Host header injection, which may result in redirecting users, forging links, or phishing. The following products a...

CVE-2025-61136

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAM...