CVE-2020-25901

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160631/Spiceworks-7.5-HTTP-Header-Injection.htmlExploit, Technical Description, Third Party Advisory, VDB Entry
https://frontend.spiceworks.com/topic/2309457-desktop-host-header-injection-vulnerabilityExploit, Vendor Advisory
https://github.com/Ramikan/Vulnerabilities/blob/master/Spiceworks%20version%207.5%20HTTP%20Header%20InjectionExploit, Third Party Advisory
http://packetstormsecurity.com/files/160631/Spiceworks-7.5-HTTP-Header-Injection.htmlExploit, Technical Description, Third Party Advisory, VDB Entry
https://frontend.spiceworks.com/topic/2309457-desktop-host-header-injection-vulnerabilityExploit, Vendor Advisory
https://github.com/Ramikan/Vulnerabilities/blob/master/Spiceworks%20version%207.5%20HTTP%20Header%20InjectionExploit, Third Party Advisory

Timeline

Published: Dec 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-259026.1Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room CVE-2020-259059.8An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) L CVE-2020-25918.2Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Application Service). The sup CVE-2020-259119.1A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an infor CVE-2020-259129.1A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to a CVE-2020-259155.4Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via cra CVE-2020-259178.8Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user CVE-2020-25925.3Vulnerability in the Oracle AutoVue product of Oracle Supply Chain (component: Security). The supported version that is affected is 21.0.2. CVE-2020-259256.1Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML vi CVE-2020-259267.5The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cach CVE-2020-259277.5The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service (remote). The c CVE-2020-259289.8The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The c