CVE-2025-43932

Summary: JobCenter before patch 7e7b0b2 is vulnerable to account takeover via the password reset flow because SERVER_NAME is not configured, making the reset rely on the Host HTTP header. This root cause enables an attacker to abuse the reset mechanism, with CVSS v3.1 metrics indicating high impa...

CVE-2025-43932

JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...