CVE-2026-94380: Host Header Injection in HAVELSAN's Liman MYS

Q: Which Liman MYS versions are affected?

The issue affects HAVELSAN Liman MYS versions from 2.3.4-1124 before 2.3.5-1131.

Q: Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates that exploitation can be performed over the network with low attack complexity and requires no privileges. It also indicates user interaction is required.

Q: What impact could successful exploitation have?

The supplied CVSS vector rates confidentiality and integrity impact as high, while availability impact is rated as none.

Published Oct 26, 2026

Updated

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

Affected Software

1 affected component

HAVELSAN Liman MYS>=2.3.4-1124<2.3.5-1131

Event History

Oct 26, 2026

CVE Published

via MITRE·11:15 AM

Data Sourced

via MITRE·11:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Liman MYS versions are affected?

The issue affects HAVELSAN Liman MYS versions from 2.3.4-1124 before 2.3.5-1131.

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates that exploitation can be performed over the network with low attack complexity and requires no privileges. It also indicates user interaction is required.

What impact could successful exploitation have?