PT-2025-43525 · Unknown+1 · Axewater Sharewarez+1

Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-61136

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions axewater sharewarez version 2.4.3

Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to potentially take over accounts by manipulating the Host header during password reset link generation, specifically when Flask's url for( external=True) is used without a defined SERVER NAME. The vulnerability enables password reset poisoning. The affected component is the password reset component.

Recommendations Ensure a fixed SERVER NAME is configured when using Flask's url for( external=True) function to generate password reset links.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-61136

Affected Products

Flask

Axewater Sharewarez

References · 10

• https://osv.dev/vulnerability/CVE-2025-61136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61136 · Security Note
• https://github.com/axewater/sharewarez/blob/d04c90b7dc3fbae1596f731d1b168d3fb9fdd2df/modules/utils_smtp.py#L191-L206 · Note
• https://github.com/axewater/sharewarez/blob/d04c90b7dc3fbae1596f731d1b168d3fb9fdd2df/modules/routes_login.py#L188-L217 · Note
• https://drive.google.com/file/d/15X5L1uEqgWOLrjKqm96cEPAWp2ph0zJp/view?usp=sharing · Note
• https://twitter.com/cracbot/status/1983126646615093455 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981415276802408489 · Twitter Post
• https://gist.github.com/BrookeYangRui/145e529b5fd4f56af299efde37edf4fa · Note
• https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning · Note
• https://twitter.com/CVEnew/status/1981379258040606922 · Twitter Post