CVE-2025-61541
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-11-06

Assigner: MITRE

Description
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-16
Last Modified
2025-11-06
Generated
2026-05-07
AI Q&A
2025-10-16
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
webmin webmin 2.510
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in Webmin 2.510 is a Host Header Injection in the password reset functionality. The reset link sent to users is created using the HTTP Host header. An attacker can manipulate this Host header to insert a malicious domain into the reset email. If a user clicks on this manipulated link, the attacker can intercept the reset token and gain full control of the user's account.


How can this vulnerability impact me? :

If exploited, this vulnerability allows an attacker to intercept password reset tokens by sending users a reset link with a malicious domain. This can lead to the attacker gaining full control over the victim's account, potentially compromising sensitive information and access.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart