userfrosting/UserFrosting

on GitHub

109 releases

new releases every 1 month 2 days

last release was 03/23/2024

last checked today at 6:40 PM

1630

Modern PHP user login and management framework

CVE History

CVE	Published	CVSS v2	CVSS v3
CVE-2021-25994	January 3, 2022	8.8 HIGH	6.8 MEDIUM
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.