Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
CWE-840, CWE-116