Threat database

UnoPim versions before 2.0.1 and 2.1.1 improperly trust all connecting clients as proxies and accept the X-Forwarded-Host header without validation. This flaw allows unauthenticated attackers to inject arbitrary origins into admin layout pages. By setting the X-Forwarded-Host header, attackers can redirect JavaScript asset loading to their own servers. When responses are cached by shared proxies, subsequent administrators may unknowingly execute attacker-supplied code within their authenticated sessions.

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.