BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-11-06

Assigner: MITRE

Description

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-11-06

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61541

EUVD

EUVD-2025-34767

Affected Vendors & Products

Vendor	Product	Version / Range
webmin	webmin	2.510

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Webmin 2.510 is a Host Header Injection in the password reset functionality. The reset link sent to users is created using the HTTP Host header. An attacker can manipulate this Host header to insert a malicious domain into the reset email. If a user clicks on this manipulated link, the attacker can intercept the reset token and gain full control of the user's account.

Impact Analysis

If exploited, this vulnerability allows an attacker to intercept password reset tokens by sending users a reset link with a malicious domain. This can lead to the attacker gaining full control over the victim's account, potentially compromising sensitive information and access.

Hi! I’m here to help you understand CVE-2025-61541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70