CVE-2017-9303

score

<0.1

cvss

6.1

epss

1.0%

published

2017-05-29

kev added

—

first seen

2026-10-21

Laravel 5.4.x before 5.4.22 contains a host header validation issue caused by improper constraint of the host portion in password-reset URLs, letting remote attackers conduct phishing attacks by specifying an attacker-controlled host, exploit requires sending a crafted password-reset URL.