High severity8.6NVD Advisory· Published Sep 20, 2019· Updated Jun 17, 2026

CVE-2019-16645

Description

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Embedthis/Goahead2 versions
cpe:2.3:a:embedthis:goahead:2.5.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:embedthis:goahead:2.5.0:*:*:*:*:*:*:*
- (no CPE)range: =2.5.0
Embedthis/GoAheaddescription

Patches

Vulnerability mechanics

References

github.com/Ramikan/Vulnerabilities/blob/master/GoAhead%20Web%20server%20HTTP%20Header%20InjectionnvdExploitThird Party Advisory
packetstormsecurity.com/files/154652/GoAhead-2.5.0-Host-Header-Injection.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.007
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000