CVE-2023-4631

ID CVE : CVE-2023-4631 Tipo de Vulnerabilidade : Spoofing de Endereço IP Descrição : O plugin DoLogin Security para WordPress é vulnerável a Spoofing de Endereço IP nas versões até, e incluindo, 3.6. Isso se deve a restrições insuficientes sobre onde as informações de endereço IP são recuperadas...

CVE-2020-35590

शोषण जानकारी शोषण शीर्षक: WordPress प्लगइन Limit Login Attempts Reloaded 2.13.0 - लॉगिन सीमा बाईपास CVE: CVE-2020-35590 दिनांक: 2020-06-09 शोषण लेखक: N4nj0 सॉफ्टवेयर लिंक: https://wordpress.org/plugins/limit-login-attempts-reloaded/ संस्करण: 2.13.0 परीक्षित: WordPress 5.4.1, 5.4.2 भेद्यता सलाह:...

CVE-2024-35584

CVE-2024-35584 OpenSIS प्रमाणित SQL इंजेक्शन विवरण Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php में SQL इंजेक्शन की कमजोरी मौजूद है। यह खोज OpenSis Community Edition 9.1 से 8.0 और संभवतः इससे निचले संस्करणों को प्रभावित करती है। प्रूफ ऑफ कॉन्सेप्ट उदाहरणों में ...

CVE-2025-66204

CVE-2025-66204: WBCE CMS يسمح بتجاوز حماية القوة الغاشمة باستخدام رأس X-Forwarded-For نظرة عامة...

CVE-2023-27100

CVE-2023-27100 - pfSense एंटी-ब्रूट फोर्स सुरक्षा बाईपास समस्या विवरण प्रमाणीकरण प्रणाली GUI का उपयोग करके लॉगिन करते समय उपयोगकर्ता कहाँ से लॉगिन करता है, इसे पूरी तरह से पहचानने के लिए IP पतों के साथ अतिरिक्त जानकारी प्रिंट करने का प्रयास करती है। इसमें प्रमाणीकरण स्रोत जैसे स्थानीय डेटाबेस, LD...

Typecho-Multiple-Vulnerabilities

Typecho ثغرات متعددة يحتوي هذا المستودع على استغلالات الثغرات التالية: CVE-2024-35538: في Typecho الإصدار 1.3.0 توجد ثغرة تزوير عنوان IP العميل، والتي تسمح للجهات الخبيثة بتزوير عناوين IP الخاصة بهم عن طريق تحديد عنوان IP عشوائي كقيمة لرؤوس "X-Forwarded-For" أو "Client-Ip" أثناء تنفيذ طلبات HTTP...

CVE-2023-27100

CVE-2023-27100 - pfSense एंटी-ब्रूट फोर्स सुरक्षा बायपास समस्या विवरण प्रमाणीकरण प्रणाली सूचनात्मक होने और GUI का उपयोग करके लॉगिन करते समय उपयोगकर्ता के लॉगिन स्थान को पूरी तरह से पहचानने के लिए IP पतों के साथ अतिरिक्त जानकारी प्रिंट करने का प्रयास करती है। इसमें प्रमाणीकरण स्रोत जैसे स्थानीय...

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticação do Kaiten Kaiten - um sistema de gerenciamento de workflow. Uma vulnerabilidade no Kaiten permite que atacantes burlem o mecanismo de autenticação por código PIN. O aplicativo exige que os usuários insiram um código PIN de 6 dígitos enviado para seu e-mail...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-25552

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

PT-2026-66835

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

CVE-2026-11922

The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

PT-2026-64225

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

CVE-2026-63770

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers...

CVE-2026-63770 Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers...