CVE-2025-61136

—

CVSS 3.1

7.1 high

EPSS

<1%p35

Published

Oct 23, 2025 (Oct 23, 2025)

Modified

Jun 17, 2026

Description

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME.

Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.