← Back

Userfrosting

userfrosting

Vendor: Userfrosting • 1 CVE

CVEs (1)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-25994
1Userfrosting
1Userfrosting
Jun 17, 2026
Jan 3, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset...Show more
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.Show less