CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Builder (pH7 Social Dating CMS) versions through 18.2.0 are vulnerable to an IP-based throttling bypass. The application resolves the client IP address in _protected/framework/Ip/Ip.class.php using the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without validating that the request originat...

CVE-2026-22201: Use of Less Trusted Source

wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTPCLIENTIP or HTTPXFORWARDEDFOR headers to spoof their IP address and circumvent...

uListing < 1.7 - Unauthenticated SQL Injections

The /1/api/ulisting-page-statistics/listing REST route did not sanitise or escape the listingid and userid GET parameters before using them in a SQL statement, leading to an SQL Injection issue. The plugin also did not sanitise and escape the HTTPCLIENTIP and HTTPXFORWARDEDFOR which are then used...

CVE-2015-9466: Improper Neutralization of Special Elements used in an SQL Command

The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTPCLIENTIP, HTTPXFORWARDEDFOR, HTTPXFORWARDED, HTTPFORWARDEDFOR, or HTTPFORWARDED variable...

BlueCMS getip()injection vulnerability-vulnerability warning-the black bar safety net

, Description,BlueCMS is a place to classified information portal dedicated CMS system. Procedures in using the getipfunction to get the Client ip when not strictly filter the data, resulting in sql injection vulnerability. Second, the analysis //comment.php $sql = "INSERT INTO ". table'comment'....

TorrentTrader scrape.php脚本SQL注入漏洞

BUGTRAQ ID: 29451 TorrentTrader是用PHP编写的torrent tracker平台。 TorrentTrader在验证访问IP列表时存在SQL漏洞，远程攻击者可能利用此漏洞绕过访问限制。 如果要下载受限制的torrent，用户要登录到TorrentTrader，然后其IP储存在许可用户的列表中。当bittorrent客户端连接时，会检查这个IP地址是否为许可用户列表中的地址。...

CVE-2008-1591: Improper Neutralization of Special Elements used in an SQL Command

The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magicquotesruntime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENTIP...

MyBulletinBoard (MyBB) 1.2.2 - 'CLIENT-IP' SQL Injection

!/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP. Неавторизованный пользователь может...

MyBulletinBoard (MyBB) 1.2.2 - CLIENT-IP SQL Injection

MyBulletinBoard MyBB 1.2.2 - CLIENT-IP SQL Injection !/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP...

CVE-2006-3775: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the init function in classsession.php in MyBB aka MyBulletinBoard 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header $SERVER'HTTPCLIENTIP' variable, as utilized by index.php...

CVE-2005-3010

CVE-2005-3010 affects CuteNews (version 1.4.0 and earlier). A direct static code injection vulnerability in the flood protection feature (inc/shows.inc.php) allows a remote attacker to inject and execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flo...

CVE-2005-3010: Undefined Security Weakness

Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTPCLIENTIP header Client-Ip, which is injected into data/flood.db.php...