Skip to content
OpenAdvisories

Vendor

userfrosting

1 known vulnerabilities.

Products

userfrosting 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2021-25994

    Userfrosting - Host-Header Injection Leads to Account Takeover

    In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully…

    userfrosting userfrosting userfrosting/userfrosting Packagist