Description
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
Remediation
References
Related Vulnerabilities
MySQL CVE-2021-35591 Vulnerability (CVE-2021-35591)
SharePoint CVE-2023-23395 Vulnerability (CVE-2023-23395)
WordPress Plugin Advanced Woo Search Unspecified Vulnerability (1.69)
WordPress Plugin Ad Manager by WD-Advanced Ad Manager Multiple Vulnerabilities (1.0.11)
WordPress Plugin VK All in One Expansion Unit Cross-Site Scripting (9.85.0.1)