‹ Back to list

CVE-2023-36085

Medium (6.1)—PoC
Routine follow-upSeverity Medium 6.1. A public proof of concept exists, but no active exploitation is known.
Severity6.1Medium · CVSS 3.1
Exploitation probability0.61 %higher than 49% of CVEs · score from Nov 5, 2026
Active exploitationNonot in the CISA catalog · checked Nov 6, 09:00 AM
Public exploitAvailableProof of concept on GitHub (unverified)

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.

Timeline

Built from our own data: NVD, CISA KEV, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

  1. CVE record published in NVD
  2. Record last modified in NVD
  3. First public exploit

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Sisqualwfm — Sisqualwfm

NVD record

NVD status
Modified
Published
Oct 25, 2023
Last modified
Jun 17, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-601

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-36085",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-25T18:17:28.223",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its \"/sisqualIdentityServer/core/\" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources."
    },
    {
      "lang": "es",
      "value": "SisqualWFM 7.1.319.103 a 7.1.319.111 para Android tiene una vulnerabilidad de inyección de encabezado de host en su endpoint \"/sisqualIdentityServer/core/\". Al modificar el encabezado del host HTTP, un atacante puede cambiar los enlaces de las páginas web e incluso redirigir a los usuarios a ubicaciones arbitrarias o maliciosas. Esto puede provocar ataques de phishing, distribución de malware y acceso no autorizado a recursos confidenciales."
    }
  ],
  "lastModified": "2026-06-17T06:05:45.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sisqualwfm:sisqualwfm:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E2D8E46-F675-48EC-99D0-2F4A30BB9C32",
              "versionEndExcluding": "7.1.319.111",
              "versionStartIncluding": "7.1.319.103"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}