Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

UnoPim admin pages may load malicious scripts

CVE-2026-102630 · published 20 days ago
Summary

Versions of UnoPim prior to 2.0.1 and 2.1.1 accept any X-Forwarded-Host header, letting an unauthenticated attacker tell the system to load JavaScript from their own server. If a shared cache stores this response, future administrators could unknowingly run the attacker’s code while logged in. Update UnoPim to the latest version or apply the vendor’s fix to stop accepting unverified host headers.

What to do
  • Update unopim unopim to version 2.0.1 or later.
Affected software
VendorProductAffected versions
unopim unopim < 2.0.1
Original advisory text
UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-348Use of Less Trusted Source
Timeline
Published29 Sep 2026
Updated9 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102630 · NVD
CVE-2026-102630 · MITRE
CVE-2026-102630 · OSV
Track software like this
Free during beta