CF-Hero

CF-Hero CF-Hero What's it? • Features • Background • Installation • Usage • Running cf-hero • ZoomEye Sponsor • To Do What's it? CF-Hero is a comprehensive reconnaissance tool developed to discover the real IP addresses of web applications protected by Cloudflare. It performs multi-source...

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Caldera Forms WordPress plugin 1.9.7 contains a reflected cross-site scripting caused by lack of validation and escaping of the cf-api parameter in responses, letting attackers execute arbitrary scripts in victim's browser, exploit requires attacker to craft a malicious request. id: CVE-2022-0879...

CVE-2026-100316

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100316

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.36.10 . The root cause is insufficient input sanitization and output escaping regarding the CF-IPCountry Header . Unauthenticated att...

CVE-2026-100316 European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-103277

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100316 European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

efcf-framework

EF/CF - the Extremely Fast ethereum smart Contract Fuzzer EF/CF is a new approach to smart contract fuzzing: instead of using a new custom built fuzzer, it repurposes existing fuzzing infrastructure of C/C++ code to smart contracts. Currently, AFL++ is the primarily supported fuzzer, although the...

CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10

CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10. A patched version of the package is available...

CVE-2026-78669 affecting package cf-cli for versions less than 8.7.11-10

CVE-2026-78669 affecting package cf-cli for versions less than 8.7.11-10. A patched version of the package is available...

CVE-2026-108812

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108812

A security vulnerability exists in SEMCMS versions up to 5.0 due to improper authorization within an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. This flaw allows for remote manipulation, potentially leading to unauthorized actions. The vendor has not responded to re...

CVE-2026-108812: Improper Authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108555

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...

CVE-2026-108555

The PairDrop application (versions through 1.11.2 ) is vulnerable to an IP spoofing issue within the Peer._setIP function. This vulnerability stems from the software's reliance on the cf-connecting-ip header, which allows remote attackers to provide a forged header. If an attacker knows a victim'...

CVE-2026-108555 PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...

CVE-2026-108555 PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...

EUVD-2026-96349

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...

CVE-2026-108555: Use of Less Trusted Source

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...

PT-2026-109669

Name of the Vulnerable Software and Affected Versions PairDrop versions prior to 1.11.3 Description An IP spoofing issue exists in the Peer. setIP function. Remote attackers can join discovery rooms of other networks by providing a forged cf-connecting-ip header. On self-hosted instances not...