ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

EUVD-2020-20522

Malware in sbrugna...

CVE-2021-20101

Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2025-40631

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

CVE-2025-40631: Improper Neutralization of HTTP Headers for Scripting Syntax

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected...

PT-2025-21634 · Icewarp · Icewarp Mail Server

Name of the Vulnerable Software and Affected Versions: Icwarp Mail Server version 11.4.0 Description: The issue allows for HTTP host header injection, enabling the execution of arbitrary JavaScript code on page load when a user interacts with a malicious link. This is achieved by modifying the Ho...

Couchbase < 7.2.6 / 7.6.x < 7.6.2 HTTP Host Header Injection

The version of Couchbase installed on the remote host is before 7.2.6, and 7.6.x before 7.6.2. It is, therefore, affected by a HTTP Host header injection. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CVE-2024-25673: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection...

PT-2024-21081

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 7.6.x through 7.6.1 Couchbase Server versions 7.2.x through 7.2.5 Couchbase Server versions prior to 7.2.x Description The issue allows HTTP Host header injection. This means an attacker could potentially manipulate t...

PT-2022-9941

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.6.1.1 through 7.6.1.2 Description The issue is caused by improper validation of input by the HOST headers, allowing a remote attacker to inject HTTP HOST headers by sending a specially crafted HTTP reques...

CVE-2021-20101

Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...

CVE-2021-20101: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...

CVE-2020-28031

CVE-2020-28031 affects eramba up to version 2.8.1, where HTTP Host header injection is possible. The impact described is that authenticated users can leverage wkhtml2pdf to print PDFs due to this header manipulation. The provided connected sources confirm the vulnerability description but do not ...

CVE-2020-28031: Improper Input Validation

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

PT-2020-16903

Name of the Vulnerable Software and Affected Versions eramba versions through c2.8.1 Description The issue allows HTTP Host header injection, which can result in wkhtml2pdf PDF printing by authenticated users. Recommendations For versions through c2.8.1, consider restricting access to authenticat...

CVE-2019-16532: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections...

CVE-2018-1943

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...

PT-2019-9806

Name of the Vulnerable Software and Affected Versions IBM Cloud Private versions 3.1.0 through 3.1.1 Description The issue is caused by improper validation of input, allowing a remote attacker to inject arbitrary HTTP headers by persuading a victim to visit a specially-crafted Web page. This coul...

CVE-2018-1943: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker t...