CVE-2025-43933

Critical

fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends…

mitre·CWE-472·Published 2025-07-07

CVSS

9.8

EPSS

0.00

KEV

Exploits

cve.orgen

164 chars

fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.

NVDen

164 chars

fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.

fblog a través de 983bede permite la toma de control de la cuenta a través de la función de restablecimiento de contraseña porque SERVER_NAME no está configurado y, por lo tanto, un restablecimiento depende del encabezado HTTP del Host.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.8	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	9.8	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H