CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

EUVD-2026-67862

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584

phpSysInfo versions ≤ 3.4.5 contain an IP allowlist bypass in the PSI_ALLOWED check within read_config.php. The vulnerable code resolves the client IP from attacker-controlled X-Forwarded-For and Client-IP headers before falling back to REMOTE_ADDR, with no trusted-proxy concept. A remote unauthe...

CVE-2023-27100

CVE-2023-27100 - pfSense Umgehung des Anti-Brute-Force-Schutzes Problembeschreibung Das Authentifizierungssystem versucht, informativ zu sein und zusätzliche Informationen zusammen mit IP-Adressen auszugeben, um vollständig zu identifizieren, von wo aus sich ein Benutzer anmeldet, wenn er sich üb...

CVE-2026-55584: Authentication Bypass by Spoofing

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

PT-2026-83254

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI ALLOWED access-control check in read config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE ADDR. A remote unauthenticated attacker can supply an allowed addre...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

Linux Distros Unpatched Vulnerability : CVE-2026-16434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard...

CVE-2026-80349: Authentication Bypass by Spoofing

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

Linux Distros Unpatched Vulnerability : CVE-2026-34959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVERREQUESTURI with no trusted-proxy check and no validation of the pref...

Improper Input Validation

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Improper Input Validation in the processing of the X-Forwarded-Prefix header due to improper validation of backslash characters. An attacker can manipulate the Set-Cookie Path...

Improper Input Validation

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Improper Input Validation via the X-Forwarded-Prefix header. An attacker can manipulate redirect destinations, control the session cookie path attribute, and poison self-referenti...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...