164 matches found
CVE-2026-55584
CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...
Linux Distros Unpatched Vulnerability : CVE-2026-55584
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts...
CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
DEBIAN-CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
UBUNTU-CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation via the readconfig.php process. An attacker can gain unauthorized access to sensitive system information by sending spoofed X-Forwarded-For or Client-IP HTTP headers to impersonate a trusted IP address. Remediation...
GHSA-786W-P5PM-CVGH phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...
CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
EUVD-2026-67862
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-55584
phpSysInfo versions ≤ 3.4.5 contain an IP allowlist bypass in the PSI_ALLOWED check within read_config.php. The vulnerable code resolves the client IP from attacker-controlled X-Forwarded-For and Client-IP headers before falling back to REMOTE_ADDR, with no trusted-proxy concept. A remote unauthe...
CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-55584: Authentication Bypass by Spoofing
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
PT-2026-83254
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI ALLOWED access-control check in read config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE ADDR. A remote unauthenticated attacker can supply an allowed addre...
phpSysInfo 3.4.5 - IP Allowlist Bypass
Exploit Title: phpSysInfo 3.4.5 - IP Allowlist Bypass Google Dork: N/A Date: 2026-07-11 Exploit Author: Muhammed Mirac Kayikci Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/ Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz Version: "Client IP...
VulnCheck KEV: CVE-2005-0869
phpSysInfo 2.3 allows remote attackers to obtain sensitive information via a direct request to 1 class.OpenBSD.inc.php, 2 class.NetBSD.inc.php, 3 class.FreeBSD.inc.php, 4 class.Darwin.inc.php, 5 XPath.class.php, 6 systemheader.php, or 7 systemfooter.php, which reveal the path in a PHP error messa...
