PT-2025-28173 · Hashview · Hashview

Rui Yang + 1 · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-43930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hashview version 0.8.1

Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header.

Recommendations: For Hashview version 0.8.1, configure the SERVER NAME to prevent the password reset feature from relying on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.

Fix

Weakness Enumeration

CWE-640

CWE-472

Related Identifiers

BDU:2026-00097

CVE-2025-43930

Affected Products

Hashview

References · 6

• https://bdu.fstec.ru/vul/2026-00097 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-43930 · Security Note
• https://github.com/hashview/hashview/issues/145 · Note
• https://github.com/hashview/hashview/blob/579a082176279f4af0e128e44c9da5667f82ec5a/hashview/users/routes.py#L198-L218 · Note
• https://twitter.com/VulmonFeeds/status/1942278907123699884 · Twitter Post
• https://twitter.com/CVEnew/status/1942246215632220492 · Twitter Post