CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0 . An attacker can send a specially crafted host header in a forgot password request to cause the system to generate password reset links pointing to an attacker-controlled server . When use...