CVE-2025-27632
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS probability
- 0.24%
- CWE
- CWE-644
- Published
- 2025-03-25
- Last modified
- 2026-03-13
Affected products
- Hitachi Energy TRMTracker
- Hitachi Energy TRMTracker
Weakness type
Related vulnerabilities
- CVE-2026-69183 — Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
- CVE-2026-67179 — Genkit improper host header validation
- CVE-2026-66778 — Multiple vulnerabilities in SAP Business AI Platform (Approuter)
- CVE-2026-72574 — picocms Pico - Host Header Injection Enables Script Source Hijacking
- CVE-2026-0516 — A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow...
- CVE-2026-48061 — Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
- CVE-2026-21762 — Missing HTTP Security Headers in DevOps Loop
- CVE-2026-54477 — Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax