CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Builder (pH7 Social Dating CMS) versions through 18.2.0 are vulnerable due to improper validation of the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers in the _protected/framework/Ip/Ip.class.php file. The application fails to verify if the request originates from a trusted proxy before resol...

uListing < 1.7 - Unauthenticated SQL Injections

The /1/api/ulisting-page-statistics/listing REST route did not sanitise or escape the listingid and userid GET parameters before using them in a SQL statement, leading to an SQL Injection issue. The plugin also did not sanitise and escape the HTTPCLIENTIP and HTTPXFORWARDEDFOR which are then used...

BlueCMS getip()injection vulnerability-vulnerability warning-the black bar safety net

, Description,BlueCMS is a place to classified information portal dedicated CMS system. Procedures in using the getipfunction to get the Client ip when not strictly filter the data, resulting in sql injection vulnerability. Second, the analysis //comment.php $sql = "INSERT INTO ". table'comment'....

TorrentTrader scrape.php脚本SQL注入漏洞

BUGTRAQ ID: 29451 TorrentTrader是用PHP编写的torrent tracker平台。 TorrentTrader在验证访问IP列表时存在SQL漏洞，远程攻击者可能利用此漏洞绕过访问限制。 如果要下载受限制的torrent，用户要登录到TorrentTrader，然后其IP储存在许可用户的列表中。当bittorrent客户端连接时，会检查这个IP地址是否为许可用户列表中的地址。...

MyBulletinBoard (MyBB) 1.2.2 - 'CLIENT-IP' SQL Injection

!/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP. Неавторизованный пользователь может...

MyBulletinBoard (MyBB) 1.2.2 - CLIENT-IP SQL Injection

MyBulletinBoard MyBB 1.2.2 - CLIENT-IP SQL Injection !/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP...

CVE-2005-3010

CVE-2005-3010 affects CuteNews (version 1.4.0 and earlier). A direct static code injection vulnerability in the flood protection feature (inc/shows.inc.php) allows a remote attacker to inject and execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flo...