CVE WATCH / VULNERABILITY DETAIL
CVE-2026-102630
MEDIUMCVSS 4.7NVD feed
Published 29 September 2026 · tracked since 30 September 2026
Description
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog