CVE-2025-62428

Name of the Vulnerable Software and Affected Versions Drawing-Captcha APP versions prior to 1.2.5-alpha-patch

Description Drawing-Captcha APP is susceptible to a Host Header Injection affecting the /register and /confirm-email API endpoints. An attacker can manipulate the Host header in HTTP requests to create malicious email confirmation links. These links can redirect users to domains controlled by the attacker. This impacts all users who depend on email confirmation for account registration or verification. The vulnerable parameters are the Host header in HTTP requests.

Recommendations Update to version 1.2.5-alpha-patch or later.