https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:10:55 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-14429 bdu:2025-14429 https://cve.radiocsirt.org/vuln/bdu:2025-14429 https://cve.radiocsirt.org/vuln/euvd-2026-255264 EUVD-2026-255264 https://cve.radiocsirt.org/vuln/euvd-2026-255264 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61541 <p>Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.</p> <p>Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-61541 https://cve.radiocsirt.org/vuln/ghsa-j92g-3wfv-qp43 <p>Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.</p> <p>Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.</p> https://cve.radiocsirt.org/vuln/ghsa-j92g-3wfv-qp43 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2297 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Webmin ausnutzen, um Passwort-Reset-Links zu manipulieren und Opfer auf bösartige Websites umzuleiten.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Webmin ausnutzen, um Passwort-Reset-Links zu manipulieren und Opfer auf bösartige Websites umzuleiten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2297