CVE-2019-16645: Embedthis GoAhead

High severity, CVSS 8.6. EPSS: 8.2% chance of exploitation in the next 30 days.

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.

Affected products

• Embedthis GoAhead: version 2.5.0 only

Published 2019-09-20. Last modified 2026-06-17.