Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Remediation

References

CVE-2016-7903

Related Vulnerabilities

WordPress Plugin ShiftNav-Responsive Mobile Menu Cross-Site Scripting (1.7.1)

phpMyFAQ Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2023-4006)

WordPress Plugin Abandoned Cart Lite for WooCommerce SQL Injection (5.8.1)

Joomla Other Vulnerability (CVE-2006-1029)

Atlassian Confluence Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2021-26084)

Severity

Low

Classification

CVE-2016-7903 CWE-264 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities