CVE-2025-53373
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.
Vendor
-
Product
-
CWE
Yayın Tarihi
2025-07-07 16:15:24
Güncelleme
2025-07-08 16:18:34
Source Identifier
security-advisories@github.com
KEV Date Added
-