CVE-2025-48865 Fabio allows HTTP clients to manipulate custom headers it adds

Fabio is an HTTPS and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and...

CVE-2025-48865

Fabio (fabio) is an HTTP(S) and TCP router for deploying Consul-managed apps. Prior to version 1.6.6, it mishandles hop-by-hop headers, allowing clients to remove or modify X-Forwarded headers (e.g., X-Forwarded-Host, X-Forwarded-Port) that Fabio injects when routing to backends. The attack relie...

CVE-2025-48865 Fabio allows HTTP clients to manipulate custom headers it adds

Fabio is an HTTPS and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and...

Fabio 安全漏洞

Fabio is a Fabio open source application. A security vulnerability exists in Fabio versions prior to 1.6.6 that stems from allowing clients to remove X-Forwarded headers when processing hop-by-hop headers, which could lead to a security hole...

Fabio allows HTTP clients to manipulate custom headers it adds

Summary Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should...

GHSA-Q7P4-7XJV-J3WF Fabio allows HTTP clients to manipulate custom headers it adds

Summary Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should...

PT-2025-23220

Name of the Vulnerable Software and Affected Versions Fabio versions prior to 1.6.6 Description Fabio is an HTTPS and TCP router for deploying applications managed by consul. A vulnerability in how it processes hop-by-hop headers allows clients to remove X-Forwarded headers except X-Forwarded-For...

CVE-2023-49182

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10...

CVE-2025-23671

CVE-2025-23671 corresponds to a Stored XSS in the WP OpenSearch WordPress plugin (Fabio Savina) affecting WP OpenSearch versions n/a through 1.0. The Red Hat and CVE listings corroborate the issue as a cross-site scripting flaw arising from improper neutralization of input during web page generat...

CVE-2024-33542

Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5...

CVE-2024-33542

CVE-2024-33542 affects Crelly Slider (WordPress plugin) up to version 1.4.5. It describes an Authorization Bypass Through User-Controlled Key vulnerability due to Insecure Direct Object References, enabling access to restricted resources by manipulating a key. The Wordfence vulnerability details ...

CVE-2024-33542 WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5...

CVE-2023-49182

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10...

CVE-2023-49182

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10...

CVE-2023-49182

CVE-2023-49182 affects the WordPress plugin “List all posts by Authors, nested Categories and Titles.” The issue is an improper input neutralization that enables a reflected XSS in listing pages. Publicly reported details indicate vulnerable versions: CVE entry notes impact through 2.7.10, while ...

PT-2023-31100 · Unknown · Fabio Marzocca List All Posts By Authors

Name of the Vulnerable Software and Affected Versions: Fabio Marzocca List all posts by Authors, nested Categories and Titles versions 2.7.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allo...

fabiotropia.it Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1176732 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Cross-site Scripting (XSS)

github.com/fabiolb/fabio is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of path and val in admin/ui/manual.go are not sanitized and can be used to inject arbitary Javascript into a victim's browser...

Updated godot packages fix security vulnerability

Updated godot packages fix security vulnerability Fabio Alessandrelli found and fixed several security vulnerabilities in the marshalling code of Godot Engine, which could be used by a remote Godot client to cause a Denial of Service for a Godot server. This update to Godot 2.1.5 fixes it, as wel...