Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
ArrowJS CMS 安全漏洞
Vulnerability Description
ArrowJS CMS是Trần Quốc Cường个人开发者的一个基于 ArrowJS 框架的 CMS。 ArrowJS CMS 1.0.0版本存在安全漏洞，该漏洞源于忘记密码功能中的主机头注入问题，通过在忘记密码请求中发送特制的主机标头，可以向用户发送密码重置链接，一旦用户点击，攻击者便能够重置用户的密码。
CVSS Information
N/A
Vulnerability Type
N/A