The vulnerability in UnoPim versions prior to 2.0.1 and 2.1.1 arises from trusting all connecting clients as proxies and honoring the X-Forwarded-Host header without proper validation. This enables unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can manipulate the X-Forwarded-Host header to redirect JavaScript asset loading to malicious servers. If these responses are cached by shared proxies, administrators accessing the admin interface later may execute attacker-controlled scripts in their authenticated context, leading to potential code execution within the admin session.

The vulnerability allows low-severity impact where attackers can cause administrators to execute attacker-controlled JavaScript code in their authenticated sessions. This can lead to limited confidentiality and integrity loss within the admin interface. There is no indication of availability impact. The attack requires user interaction (UI:R) and has a high attack complexity (AC:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor vendor communications for updates. Until a fix is available, restricting access to the admin interface and controlling proxy configurations may reduce exposure.