CVE-2016-7903

3.7 lowEPSS 1.1%

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Severity

CVSS 3.0

3.7 low

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2017-01-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotclear:dotclear

References

http://www.openwall.com/lists/oss-security/2016/10/05/5
http://www.securityfocus.com/bid/93439
https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3
https://hg.dotclear.org/dotclear/rev/bb06343f4247
http://www.openwall.com/lists/oss-security/2016/10/05/5

Check your stack JSON