2 matches found
CVE-2025-54597
LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
CVE-2025-50578
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading o...