CVE-2016-10073

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.htmlExploit, Third Party Advisory
https://open.vanillaforums.com/discussion/33498/critical-security-release-vanilla-2-3-1Patch, Vendor Advisory
https://www.exploit-db.com/exploits/41996/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.htmlExploit, Third Party Advisory
https://open.vanillaforums.com/discussion/33498/critical-security-release-vanilla-2-3-1Patch, Vendor Advisory
https://www.exploit-db.com/exploits/41996/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-100749.8The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to CVE-2016-100757.8The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious gi CVE-2016-100797.5SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port CVE-2016-10088.4Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, a CVE-2016-100817.8/usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that CVE-2016-100829.8include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during CVE-2016-100836.1Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script CVE-2016-100847.2admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['CVE-2016-100857.2admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab paramet CVE-2016-100868.1RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or m CVE-2016-100877.5The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.CVE-2016-100887.0The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option i