CVE-2026-102630: falha de baixa gravidade em unopim
UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
Publicada em · Atualizada em
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.1%
probabilidade de exploração
0.1%top 99% das CVEs
exploração observada
nãonenhuma fonte reporta
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
unopim · unopimCVEs relacionadas — unopim
No mesmo produto, das mais perigosas para as menos.
CVE-2025-55745LOWUnoPim Quick Export feature is vulnerable to CSV injectionEPSS 0.6%CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-55743HIGHUnoPim vulnerable to remote code execution through Arbitrary File uploadEPSS 0.5%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2025-55742HIGHUnoPim Stored XSS via SVG MIME/Sanitizer BypassEPSS 0.4%
Referências
https://github.com/unopim/unopimhttps://github.com/unopim/unopim/blob/v2.1.0/bootstrap/app.php#L24https://github.com/unopim/unopim/blob/v2.1.0/packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php#L9https://github.com/unopim/unopim/commit/77e33618df5ba82fc9c9a32d137368e5bbe5ac9chttps://github.com/unopim/unopim/releases/tag/v2.0.1https://github.com/unopim/unopim/releases/tag/v2.1.1https://www.vulncheck.com/advisories/unopim-2.0.0-before-2.0.1-and-2.1.0-before-2.1.1-cache-poisoning-via-x-forwarded-host