CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0 . By submitting a specially crafted host header during a forgot password request, an attacker can cause the system to generate password reset links pointing to an attacker-controlled server...