transfer.sh

SECURITY WARNING IPフィルターとHTTP認証のバイパス（認証なしのX-Forwarded-Forヘッダースプーフィングによる） transfer.sh コマンドラインから簡単かつ高速にファイル共有ができます。このコードには、ご自身のインスタンスを作成するために必要なすべてが含まれています。 Transfer.shは現在、s3（Amazon S3）、gdrive（Google Drive）、storj（Storj）プロバイダー、およびローカルファイルシステム（local）をサポートしています。 免責事項...

Silent-Call

Silent;Call Cisco Unified Communications Manager 15.x 上的预认证远程 root 漏洞 三个 HTTP 请求。零凭据。root 权限。每一通电话现在都归你所有。 攻击链 步骤| 组件| 描述 ---|---|--- 1| Spoofhack| X-Forwarded-For 请求头欺骗绕过 Tomcat Manager 上的 localhost 限制 2| Keyhack| 硬编码凭据（在所有 CUCM 安装上均相同）允许进行 WAR 部署 3| Roothack| 对 gdb 的无密码 sudo 加上攻击者控制的命令文件 → root...

CVE-2015-3224

Ruby on Rails Web 控制台漏洞利用 CVE-2015-3224 此仓库包含一个 Python 脚本 ，用于利用 Ruby on Rails 4.0.x 和 4.1.x 开发者 Web 控制台中的 IP 白名单绕过漏洞 。该脚本可在易受攻击的服务器上实现 远程代码执行 。 ⚠️ 免责声明 此脚本仅用于教育目的和经授权的安全测试。 请勿 在未经明确许可的情况下在任何系统上使用它。 作者不承担 任何因使用此脚本而导致的滥用或损害责任。 📌 漏洞描述 在易受攻击的 Ruby on Rails 版本中，Web 控制台仅供开发用途，应只能从受信任的 IP 地址访问。然而，由于对...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

EUVD-2026-78300

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2015-3224

CVE-2015-3224 エクスプロイト - Rails Web Console RCE CVE-2015-3224 のエクスプロイトのJavaScript実装（Node.js）です。このツールは、脆弱性のあるバージョンの web-console gem を実行しているRuby on Railsアプリケーションを標的とし、認証なしのリモートコード実行（RCE）を可能にします。 脆弱性について CVE-2015-3224 により、攻撃者はRailsの web-console gem のIPホワイトリスト保護をバイパスできます。 web-console...

EUVD-2026-67862

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

phpSysInfo 3.4.5 - IP Allowlist Bypass

Exploit Title: phpSysInfo 3.4.5 - IP Allowlist Bypass Google Dork: N/A Date: 2026-07-11 Exploit Author: Muhammed Mirac Kayikci Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/ Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz Version: "Client IP...

GHSA-9W88-79F8-M3VP Permissive List of Allowed Inputs in ewe

Summary ewe's chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denylist only blocks 9 header names. Security-sensitive headers like authorization, cookie, and x-forwarded-for can be injected or overwritten by a malicious client...

CVE-2026-23848

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via X-Forwarded-For header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attackers can spoof client IPs by manipulating...