CVE-2025-61543

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST']` directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks or account takeover.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2025-10-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61543
https://owasp.org/www-community/vulnerabilities/HTTP_Host_header_injection

Check your stack JSON