Remote Code Execution Vulnerability in UnoPim by UnoPim

CVE-2026-102630

What is CVE-2026-102630?

UnoPim versions prior to 2.0.1 and 2.1.1 exhibit a serious vulnerability where all connecting clients are implicitly trusted, allowing attackers to manipulate the X-Forwarded-Host header without proper validation. This flaw enables unauthenticated attackers to inject arbitrary origins into admin layout pages. By setting the X-Forwarded-Host header, attackers can reroute JavaScript asset loading to their malicious servers. This poses a significant risk, as cached responses by shared proxies can subsequently lead to execution of attacker-supplied scripts in the authenticated sessions of administrators.

References