CVE-2023-27100

CVE-2023-27100 - pfSense 防暴力破解机制绕过 问题描述 认证系统试图提供详细信息，在用户通过GUI登录时，连同IP地址一起打印额外信息以完全识别用户登录位置。这些信息包括认证源（如本地数据库、LDAP或RADIUS、认证服务器名称），以及代理头X-Forwarded-For和Client-IP的内容，以进一步明确用户确切位置。 这些额外信息会在各种地方（包括认证日志消息）中远程用户的IP地址之后打印。对于GUI登录失败的情况，日志条目包含了客户端提交的代理头（X-Forwarded-For或Client-IP）的内容。...

CVE-2025-66204

CVE-2025-66204: WBCE CMS permite la omisión de la protección contra fuerza bruta mediante la cabecera X-Forwarded-For Resumen...

CVE-2023-4631

CVE ID : CVE-2023-4631 漏洞类型 : IP地址欺骗 描述 : WordPress的DoLogin Security插件在版本3.6及之前版本中存在IP地址欺骗漏洞。这是由于在请求日志记录和登录限制时，对IP地址信息获取位置的限制不足。攻击者可以提供带有不同IP地址的X-Forwarded-For头部，该地址将被记录，并可用于绕过已阻止某个IP地址登录的设置。 复现步骤 : 1. 发送带有x-forwarded-for头部的登录请求，例如 X-Forwarded-For: 8.8.8.8。 2. 在“登录尝试日志”中看到被伪造的IP地址。 参考链接 : 1...

CVE-2024-41276

CVE-2024-41276（Kaiten 认证绕过） Kaiten —— 一个工作流管理系统。 Kaiten 中的一个漏洞允许攻击者绕过 PIN 码认证机制。该应用要求用户在输入登录凭证后，输入发送到其邮箱的6位 PIN 码进行授权。然而，请求限制机制可以被轻松绕过，使得攻击者能够进行暴力破解攻击，猜出正确的 PIN 码并未经授权访问应用。 详细信息： 认证机制使用发送到邮箱的单因素，没有任何密码 : 通过使用 X-Forwarded-For 头可以绕过速率限制，该头允许 X-RateLimit-Remaining 计数器重置。 这种方法使得可以持续发送请求而不收到 HTTP 429...

CVE-2024-35584

CVE-2024-35584 OpenSIS 认证 SQL 注入 描述 Ajax.php、ForWindow.php、ForExport.php、Modules.php、functions/HackingLogFnc.php 中存在 SQL 注入漏洞。该漏洞影响 OpenSis Community Edition 9.1 至 8.0，以及可能更低的版本。 概念验证 以 Ajax.php 为例，可以看到当检测到恶意活动时，IP 可以被记录并插入数据库。需要注意的一点是，如果发送了“X-Forwarded-For”头，应用程序将使用该值而不是 $SERVER'REMOTEADDR' 的值。由...

Typecho-Multiple-Vulnerabilities

Typecho Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2024-35538: In Typecho v1.3.0 there is a Client IP Spoofing vulnerability, which allows malicious actors to falsify their IP addresses by specifying an arbitrary IP as value of...

CVE-2026-18579

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18579 WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-75953

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18579

WP Photo Album Plus (WordPress plugin) versions up to and including 9.2.08.003 are vulnerable to unauthenticated Stored XSS via the HTTP_X_FORWARDED_FOR parameter. The root cause is insufficient input sanitization and output escaping: a deliberately failed nonce check on the getshortcodedrendered...

CVE-2020-35590

漏洞利用信息 漏洞标题： WordPress 插件 Limit Login Attempts Reloaded 2.13.0 - 登录限制绕过 CVE： CVE-2020-35590 日期： 2020-06-09 漏洞作者： N4nj0 软件链接： https://wordpress.org/plugins/limit-login-attempts-reloaded/ 版本： 2.13.0 测试环境： WordPress 5.4.1, 5.4.2 漏洞公告：...

CVE-2015-8562

CVE-2015-8562 - Reverse shell python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: root@kitploit: Fecha de la vulnerabilidad: 17/12/2015 Autor del exploit: anarc0der Versión: Joomla 1.5 a 3.4.5 CVE : CVE-2015-8562 Cómo usarlo: root@kitploit: Abre una terminal y escucha...

EUVD-2026-71934

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-83625

The Contact Form by Supsystic WordPress plugin (all versions up to and including 1.10.2 ) is vulnerable to unauthenticated stored XSS via insufficient input sanitization and output escaping. An attacker exploits the updateNonce action—accessible without authentication because it is absent from th...

CVE-2026-82815

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The...

CVE-2026-82815

MegaEase EaseProbe (up to version 2.3.0) contains an improper access control flaw in the realIP function of web/server.go (Middleware component). An attacker can manipulate the X-Forwarded-For , X-Real-IP , or True-Client-IP headers to bypass access controls. The attack is remote , requires no pr...

CVE-2023-27100

CVE-2023-27100 - pfSense Umgehung des Anti-Brute-Force-Schutzes Problembeschreibung Das Authentifizierungssystem versucht, informativ zu sein und zusätzliche Informationen zusammen mit IP-Adressen auszugeben, um vollständig zu identifizieren, von wo aus sich ein Benutzer anmeldet, wenn er sich üb...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...