Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-43935
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-26 May, 2026 | 15:01
Updated At-26 May, 2026 | 15:49
Rejected At-
▼CVE Numbering Authority (CNA)
e107: Host Header Injection in e107 password reset enables phishing

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.

Affected Products
Vendor
e107inc
Product
e107
Versions
Affected
  • < 2.3.4
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20: Improper Input Validation
CWECWE-807CWE-807: Reliance on Untrusted Inputs in a Security Decision
Type: CWE
CWE ID: CWE-20
Description: CWE-20: Improper Input Validation
Type: CWE
CWE ID: CWE-807
Description: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Metrics
VersionBase scoreBase severityVector
3.18.1HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x
x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6
x_refsource_MISC
https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357
x_refsource_MISC
https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc
x_refsource_MISC
Hyperlink: https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6
Resource:
x_refsource_MISC
Hyperlink: https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357
Resource:
x_refsource_MISC
Hyperlink: https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x
exploit
Hyperlink: https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x
Resource:
exploit
Details not found