CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

Code injection

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

CVE-2022-24594 affects waline 1.6.1. An attacker can submit messages with a forged IP address by manipulating the X-Forwarded-For header, enabling IP spoofing. Multiple connected sources (Red Hat advisory, Veracode note) indicate this can bypass IP-related checks such as IP frequency limits, affe...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594: Missing Authorization

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

WordPress Perfect Survey plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...

Cross site scripting

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24765

The CVE-2021-24765 issue affects the WordPress Perfect Survey plugin up to version 1.5.2. The root cause is failure to validate/escape the X-Forwarded-For header when Anonymize IP is off, allowing Stored Cross-Site Scripting on the statistic page. Affected component: the plugin’s statistic page r...

CVE-2021-24765: Improper Neutralization of Input During Web Page Generation

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

Cross site scripting

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry...

CVE-2021-25080: Improper Neutralization of Input During Web Page Generation

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry...

CVE-2021-24964: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if...

CVE-2021-36916: Improper Neutralization of Special Elements used in an SQL Command

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-35503

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...

Cross site scripting

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...

CVE-2021-35503

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...

CVE-2021-35503

CVE-2021-35503 affects Afian FileRun 2021.03.26. The issue is a stored XSS caused by mishandling of the HTTP X-Forwarded-For header when rendering Activity Logs, implying user-supplied header data could be reflected in logs and executed in the browser. The description identifies the affected comp...

CVE-2021-35503: Improper Neutralization of Input During Web Page Generation

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...

PT-2021-16170

Name of the Vulnerable Software and Affected Versions Limit Login Attempts WordPress plugin versions prior to 4.0.50 Description The issue arises from the plugin not escaping IP addresses of attempted logins before outputting them in the reports table. This can be exploited by an attacker...