CVE-2024-29643: Croogo

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

Affected products

• Croogo Croogo: version 3.0.2 only

Published 2025-04-18. Last modified 2026-06-17.