CVE-2025-13434
jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax
- State
- Published
- Severity
- 6.9 Medium
- Published
- Nov 20, 2025
- Updated
- Nov 20, 2025
- Reserved
- Nov 19, 2025
Description
A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the component HTTP Host Header Handler. This manipulation of the argument $_SERVER['HOST'] causes improper neutralization of http headers for scripting syntax. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected Products
| Product | Versions |
|---|---|
Hush Frameworkjameschz |
|
References
- VDB-332978 | jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntaxvdb-entrytechnical-description
- VDB-332978 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #687568 | jameschz Hush 2.0 Improper Neutralization of HTTP Headers for Scripting Syntaxthird-party-advisory
- https://github.com/lakshayyverma/CVE-Discovery/blob/main/hush.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.