A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42903.json"