1018 matches found
CVE-2026-126400
The software Password Pusher versions 1.49.0 before 2.17.0 is vulnerable to IP spoofing due to the use of unanchored trusted-proxy regular expressions. This flaw allows remote clients—specifically those in the 110.0.0.0/8 or 210.0.0.0/8 ranges, or those connecting directly—to supply X-Forwarded-F...
EUVD-2026-125165
Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify...
CVE-2026-72815-poc
CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC 日本語版 Overview This repository contains a local Proof of Concept PoC for CVE-2026-72815 GHSA-3fxj-6jh8-hvhx, an IP spoofing vulnerability in go-chi/chi's middleware.RealIP. The vulnerable middleware blindly trusts the first leftmost valu...
CVE-2025-12720
g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; The fflcockpitisallowed function uses a hardcoded IP address base64: My4yMTIuMTg1LjE4Nw==, d...
burpFakeIP
burpFakeIP Download and use: Releases 2021/09/24 1. Fixed a bug reported by M00nBack. 2. Added an AutoXFF switch, and set AutoXFF to disabled by default. If you need the plugin to add a random XFF header to every request, you can select ON in the right-click menu to enable it. 2021/05/21 Refactor...
CVE-2021-40438
CVE-2021-40438 Apache forward request CVE CVE-2021-40438: A crafted request uri-path can cause modproxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. This CVE could be used to spoof the original IPs in DoS attacks...
burpsuiefakeip
Reposted from https://github.com/TheKingOfDuck/burpFakeIP BurpFakeIP Forging IP in Burp Suite, and I'm dead serious. Four small features Forge a specified IP Forge a local IP Forge a random IP Random IP brute-forcing 0x01 Forge a specified IP In the Repeater module, right-click to select the fake...
CVE-2026-121619
The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...
Mr.SIP
SIP Security, Attack and Audit Framework Mr.SIP is...
EUVD-2026-124613
The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...
CVE-2026-121619
The Symfony FrameworkBundle (framework.trusted_proxies option) and HttpFoundation (Request::setTrustedProxies() method) are vulnerable to IP spoofing when the private_ranges shortcut is used. The root cause is that private_ranges resolves to a list that includes IPv6 prefixes embedding IPv4 addre...
CVE-2026-121619 Symfony: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
The Symfony FrameworkBundle framework.trustedproxies option and the HttpFoundation Request::setTrustedProxies method trust remote clients as reverse proxies when the privateranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundl...
Nac_Bypass_Agent
Nac Bypass Agent This piece of code is a script written in Python and designed to run on Kali Linux. Here is a summary explaining what each function does: runcommandcommand: This function runs the command it takes as input and returns its output. killnetworkservices: This function stops the...
dontgo403
dontgo403 is a tool to bypass 40X errors. Installation Grab the latest release for your OS from RELEASES Outdated atm Or compile by your own RECOMMENDED: git clone https://github.com/devploit/dontgo403; cd dontgo403; go get; go build Customization If you want to edit or add new bypasses, you can...
CVE-2022-46169
CVE-2022-46169 Cacti Blind Remote Code Execution Pre-Auth Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. Explanation This script bruteforces variables required to exploit this vulnerability. This exploit requires the following ...
Cisco-SNMP-Slap
OVERVIEW cisco-snmp-slap utilises IP address spoofing in order to bypass an ACL protecting an SNMP service on a Cisco IOS device. Typically IP spoofing has limited use during real attacks outside DoS. Any TCP service cannot complete the inital handshake. UDP packets are easier to spoof but the...
CVE-2026-14840
CVE-2026-14840 — YOP Poll 7.0.6 Vote Limit Bypass Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? YOP Poll plugin versions 7.0.6 enforce a one-vote-per-IP limit. The problem is that to obtain the client IP it checks HTTPCLIENTIP and...
CVE-2026-119039
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and...
EUVD-2026-124275
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and...