CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml The essence of this vulnerability is similar to CVE-2021-45232, both bypass authorization or are unauthenticated, to execute malicious filterfunc or script in a route to execute commands...

CVE-2026-89093

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

EUVD-2026-83478

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

CVE-2026-89093

The Better Messages WordPress plugin (versions up to and including 2.15.33 ) is vulnerable to Information Exposure by Spoofing . The is_ai_bot_user() function identifies privileged internal AI bot accounts by checking for the prefix 'ai-chat-bot-' against a guest record's stored IP address, which...

CVE-2026-82530

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

EUVD-2026-75018

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530

The IP2Location Country Blocker WordPress plugin, versions prior to 2.45.0 , is vulnerable to an access control bypass via a forged X-Real-IP HTTP header. Unauthenticated remote attackers can set this header to an allowlisted IP address to circumvent page-, link-, or site-wide IP-based restrictio...

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

CVE-2026-84476

WWBN AVideo contains an authentication bypass flaw in its login rate limiting mechanism. The application fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, which are consumed by the enforceRateLimit() function. An unauthenticated, network-based attacker can ...

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

CVE-2026-45045

A flaw was found in the GoFiber web framework's BalancerForward proxy helper. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Real-IP header. Because the Header.Add function is used instead of Header.Set, an attacker-supplied X-Real-IP value is forwarde...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

SUSE CVE-2026-45045

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add instead of Header.Set when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream serve...

CVE-2026-14592

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...

GO-2026-5774 Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi...

GO-2026-5887 GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add in BalancerForward in github.com/gofiber/fiber...

CVE-2026-64619

FileCodeBox prior to 2.4 is affected by a rate-limit bypass in the IPRateLimit component. An unauthenticated attacker can spoof X-Real-IP and X-Forwarded-For headers without verifying the trusted reverse proxy origin, sending unique IP values per request to enumerate all share codes and access ot...

CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...

CVE-2026-45045

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add instead of Header.Set when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream serve...