Login Request a demo
Critical severity · published Jan 13, 2026
CVE-2022-50910
Beehive Forum - Account Takeover
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can inject a malicious host header to intercept password reset tokens and change victim account passwords without direct authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Beehive Forum · Beehive Forum
1.5.2 · source: vendor, NVD
Affected product
BF
Beehive Forum
Beehive Forum
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-50910
Exploit
https://imgur.com/a/hVlgpCg
Product
https://sourceforge.net/projects/beehiveforum/
Product
https://www.beehiveforum.co.uk/
Exploit
https://www.exploit-db.com/exploits/50923
Third Party Advisory
https://www.vulncheck.com/advisories/beehive-forum-account-takeover
More from Beehive Forum
–
CVE-2015-2198
Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVE-2012-0900
Multiple cross-site scripting (XSS) vulnerabilities in Beehive Forum 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)…
–
CVE-2007-6014
SQL injection vulnerability in post.php in Beehive Forum 0.7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the t_dedupe parameter
–
CVE-2007-6241
Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, different issues than CVE-2007-6014
–
CVE-2007-3212
Multiple cross-site scripting (XSS) vulnerabilities in links.php in Beehive Forum 0.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) viewmode, (2)…