CVE-2025-61536

FelixRiddle dev-jobs-handlebars 1.0 is vulnerable to an unverified password change issue because it generates absolute password-reset (magic) links using the untrusted req.headers.host header while forcing the http:// scheme. An attacker capable of controlling the Host header—or exploiting a misc...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-61543: Improper Access Control

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-62586: Missing Authentication for Critical Function

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0...

Dev jobs handlebars 安全漏洞

Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...

CVE-2025-61541

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

CVE-2025-22381

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

PT-2025-42478

Name of the Vulnerable Software and Affected Versions CraftMyCMS version 4.0.2.2 Description A Host Header Injection issue exists in the password reset functionality. The system directly uses $ SERVER'HTTP HOST' to create password reset links sent through email. An attacker can manipulate the Hos...

CVE-2025-22381: Unverified Password Change

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

PT-2025-42522

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.2.0 Description A remote, unauthenticated attacker can reset the administrator password in OPEXUS FOIAXpress. Recommendations Update to version 11.13.2.0 or later...

CVE-2025-22381

The TID-Lab/aggie open-source project, specifically version 2.6.1 and earlier, is vulnerable to a Host Header injection in the forgot password functionality. The root cause is located in the lib/api/reset-password.js file, where the sendEmail helper function uses the attacker-controlled req.heade...

CVE-2025-22381

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

CVE-2025-61536

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...

Aggie 安全漏洞

aggie is Technology & International Development Lab's open source software for tracking events around real-time events such as elections or natural disasters using social media and other sources. Aggie version 2.6.1 has a security vulnerability that stems from a host header injection in the Forgo...

Webmin 安全漏洞

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.510, which stems from an unvalidated HTTP Host header in the password reset function, which could allow an attacker to...

CVE-2025-61541

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

CVE-2025-61541

The Webmin hosting control panel (version 2.510 ) is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi ). The root cause is an unvalidated HTTP Host header used by the get_webmin_email_url() function to construct reset links. An attacker can manipulate thi...

CVE-2025-61536

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...

CVE-2025-61541: Improper Access Control

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...