Natours vulnerabilities

1 known vulnerability in Natours from Ahmed-elgaml11. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.9 High severity

  Natours: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2025-53373Jul 7, 2025Ahmed-elgaml11

  Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c