Back to search
CVE-2025-27913
Published: Mar 10, 2025
Modified: Mar 11, 2025
PUBLISHED
Description
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
| Vendor | Product | Versions |
|---|---|---|
Passbolt | API | affected 0 - < 5 |
Weaknesses (CWE)
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now