CVE-2024-12925 HIGH

CVE-2024-12925: Host Header Injection in Akinsoft's QR Menu

Vendor Akınsoft

Product QR Menü

Weakness CWE-297

Published September 1, 2025

Last update June 1, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP Response Splitting. This issue affects QR Menü: from s1.05.05 before v1.05.12.

Key dates

02Disclosure timeline

September 1, 2025 CVE published

June 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12925 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/297.html

Related vulnerabilities

04Related CVE

CVE-2022-32153 Splunk Enterprise lacked TLS host name validation CVE-2025-2190 CVE-2025-68637 Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client CVE-2026-35563 Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname CVE-2026-26214 Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM