CVE-2025-4295 MEDIUM

CVE-2025-4295: Host Header Injection in HotelRunner's B2B

Vendor Hotelrunner
Product B2B
Weakness CWE-297
Published July 22, 2025
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025.

Key dates

02Disclosure timeline

July 22, 2025 CVE published
June 5, 2026 Record updated