CVE-2025-61543

CVE-2025-61543CVE-2025-61543

Description

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST']` directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks or account takeover.

Scoring

CVSS 7.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Last modified2026-11-05
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.