CVE-2026-102630lowCWE-348

CVE-2026-102630: fallo de gravedad baja en unopim

UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host

Publicada el · Actualizada el

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.3epss 0.1%
probabilidad de explotación
0.1%top 99% de las CVE
explotación observada
noninguna fuente lo reporta
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
unopim · unopim
CVEs relacionadas — unopim

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-55745LOWUnoPim Quick Export feature is vulnerable to CSV injectionEPSS 0.6%CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-55743HIGHUnoPim vulnerable to remote code execution through Arbitrary File uploadEPSS 0.5%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2025-55742HIGHUnoPim Stored XSS via SVG MIME/Sanitizer BypassEPSS 0.4%
Referencias
https://github.com/unopim/unopimhttps://github.com/unopim/unopim/blob/v2.1.0/bootstrap/app.php#L24https://github.com/unopim/unopim/blob/v2.1.0/packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php#L9https://github.com/unopim/unopim/commit/77e33618df5ba82fc9c9a32d137368e5bbe5ac9chttps://github.com/unopim/unopim/releases/tag/v2.0.1https://github.com/unopim/unopim/releases/tag/v2.1.1https://www.vulncheck.com/advisories/unopim-2.0.0-before-2.0.1-and-2.1.0-before-2.1.1-cache-poisoning-via-x-forwarded-host