Triofox Host Header Attack CVE-2025-12480

Tim Peck@timpeck

•updated Nov 10, 2025•2•0•84

Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.