Security Advisory

CVE-2025-53373

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-07-07 15:38:42

Last updated 2025-07-07 15:47:18

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.

← Browse all CVEs View on cve.org ↗