UnoPim versions before 2.0.1 and 2.1.1 improperly trust all connecting clients as proxies and accept the X-Forwarded-Host header without validation. This flaw allows unauthenticated attackers to inject arbitrary origins into admin layout pages. By setting the X-Forwarded-Host header, attackers can redirect JavaScript asset loading to their own servers. When responses are cached by shared proxies, subsequent administrators may unknowingly execute attacker-supplied code within their authenticated sessions.