CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension

Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...

CVE-2026-64797

Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...

CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

EUVD-2026-47810

IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

CVE-2026-63683

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

CVE-2026-63683

A Client IP spoofing vulnerability exists in the Regular Labs conditions manager for the Joomla Extension by regularlabs.com . The root cause is that the extension's IP and GeoIP conditions trust spoofable forwarded headers , which allows remote clients to bypass location-based rules. No specific...

PT-2026-63499

IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

PT-2026-63564

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...

PT-2026-63508

Name of the Vulnerable Software and Affected Versions IP Login affected versions not specified Description The IP Login extension for Joomla trusts forwarded client-IP headers without requiring a configured trusted proxy. This allows attackers to spoof the IP address used for automatic login, whi...

CVE-2026-64797: Authentication Bypass by Spoofing

Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...

CVE-2026-63683: Authentication Bypass by Spoofing

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

CVE-2026-50755

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...

EUVD-2026-42325

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...

CVE-2026-50755

A vulnerability in DayuanJiang next-ai-draw-io version 0.4.13 allows a remote attacker to obtain sensitive information by manipulating the X-Forwarded-For header value. This issue can lead to the disclosure of internal information via header spoofing. Currently, there is no information regarding ...

CVE-2026-50755

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...

CVE-2026-50755

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...

PT-2026-62081

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information by manipulating the X-Forwarded-For header value. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-50755: Authentication Bypass by Spoofing

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...