CVE-2025-62586: Missing Authentication for Critical Function

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0...

Dev jobs handlebars 安全漏洞

Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...

CVE-2025-61541

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

PT-2025-42522

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.2.0 Description A remote, unauthenticated attacker can reset the administrator password in OPEXUS FOIAXpress. Recommendations Update to version 11.13.2.0 or later...

CVE-2025-22381

The TID-Lab/aggie open-source project, specifically version 2.6.1 and earlier, is vulnerable to a Host Header injection in the forgot password functionality. The root cause is located in the lib/api/reset-password.js file, where the sendEmail helper function uses the attacker-controlled req.heade...

CVE-2025-22381

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

CVE-2025-22381

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

CVE-2025-22381: Unverified Password Change

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password...

PT-2025-42478

Name of the Vulnerable Software and Affected Versions CraftMyCMS version 4.0.2.2 Description A Host Header Injection issue exists in the password reset functionality. The system directly uses $ SERVER'HTTP HOST' to create password reset links sent through email. An attacker can manipulate the Hos...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-61543: Improper Access Control

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses $SERVER'HTTPHOST' directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks ...

CVE-2025-61543

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS version 4.0.2.2 . The software fails to sanitize the $_SERVER['HTTP_HOST'] variable, which is used directly to construct password reset links sent via email. An attacker can manipulate the Host header t...

CVE-2025-61536

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...

Aggie 安全漏洞

aggie is Technology & International Development Lab's open source software for tracking events around real-time events such as elections or natural disasters using social media and other sources. Aggie version 2.6.1 has a security vulnerability that stems from a host header injection in the Forgo...

Webmin 安全漏洞

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.510, which stems from an unvalidated HTTP Host header in the password reset function, which could allow an attacker to...

EUVD-2025-34619

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts...

CVE-2025-56748

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts...

CVE-2025-56748

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts...

BIT-MASTODON-2025-62174 Mastodon allows continued access after password reset via CLI

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using bin/tootctl accounts modify --reset-password, active sessions and access tokens for...