requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

CVE-2023-4549

ID de CVE : CVE-2023-4549 Tipo de Vulnerabilidad : Cross-Site Scripting Descripción : El plugin DoLogin Security para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del encabezado 'X-Forwarded-For' en versiones hasta la 3.6 inclusive, debido a una insuficiente sanitización de...

transfer.sh

SECURITY WARNING IP filter and HTTP auth bypass via unauthenticated X-Forwarded-For header spoofing transfer.sh...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authentication Bypass Advanced Bypass 🔥 Overview An advanced PoC for CVE-2025-29927 , allowing authentication bypass in Next.js Middleware by manipulating specific headers. This template enhances WAF evasion and security bypass techniques. 🚀 Features ✅...

ivantiunlocker

ivantiunlocker Previene CVE-2025-22457 y otros problemas de seguridad con Juniper/Ivanti Secure Connect SSL VPN Muchos problemas de seguridad en torno a los dispositivos SSL VPN recientemente. Ya no puedes sentirte seguro. Y luego está CVE-2025-22457 ! Lee la historia detrás de esto :...

Typecho-Multiple-Vulnerabilities

Múltiples Vulnerabilidades en Typecho Este repositorio contiene los exploits de las siguientes vulnerabilidades: CVE-2024-35538: En Typecho v1.3.0 existe una vulnerabilidad de Suplantación de IP del Cliente, que permite a actores maliciosos falsificar sus direcciones IP especificando una IP...

burpFakeIP

burpFakeIP 下载使用：Releases 2021/09/24 1. 修复M00nBack反馈的一个bug。 2. 添加了AutoXFF的开关,并将AutoXFF默认设置不开启,如需让插件给每个请求头添加一个随机的XFF请求头可在右键菜单中选择ON开启 2021/05/21 使用Java重构，增加了issue中提到的功能特性，新增给每个请求自动添加XFF头以及随机IP的功能，具体可见右键菜单AutoXFF,默认情况下自动添加的xff头为X-Forwarded-For,值为生成的随机IP,均可自定义。 2020/04/25 优化代码，新增9种请求头。 四个小功能 伪造指定ip...

CVE-2022-46169

Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...

CVE-2026-37432

CVE-2026-37432 Location: Apiutil.java: 107-113 Principle: Directly trusting the X-Forwarded-For request header, which can be forged to manipulate IP addresses. Exploitation method: X-Forwarded-For: 127.0.0.1...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

CVE-2015-3224

Exploit CVE-2015-3224 - RCE en Rails Web Console Una implementación en JavaScript Node.js del exploit para CVE-2015-3224. Esta herramienta apunta a aplicaciones Ruby on Rails que ejecuten versiones vulnerables de la gema web-console, permitiendo Ejecución Remota de Código RCE no autenticada. Acer...

CVE-2019-19633

CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...

fireprox

FireProx Resumen Beneficios Descargos Mantenedor Crédito Uso básico Instalación Capturas de pantalla Contribuir Resumen Poder ocultar o rotar continuamente la dirección IP de origen al realizar llamadas web puede ser difícil o costoso. Durante algún tiempo han existido varias herramientas, pero...

CVE-2015-3224

Exploit de la Consola Web de Ruby on Rails CVE-2015-3224 Este repositorio contiene un script en Python para explotar una vulnerabilidad de omisión de la lista blanca de IP en la consola web de desarrollo de Ruby on Rails 4.0.x y 4.1.x. El script permite la ejecución remota de código en servidores...

CVE-2023-27100

CVE-2023-27100 - Omisión de protección anti-fuerza bruta en pfSense Descripción del problema El sistema de autenticación intenta ser informativo e imprime información adicional junto con las direcciones IP para identificar completamente desde dónde inicia sesión un usuario cuando lo hace a través...

CVE-2024-35584

CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...

CVE-2023-4631

CVE ID : CVE-2023-4631 Vulnerability Type : IP Address Spoofing Description : The DoLogin Security plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 3.6. This is due to insufficient restrictions on where the IP Address information is being retrieved for...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentication Bypass 🔎 Overview CVE-2025-2825 is a critical authentication bypass vulnerability affecting CrushFTP , a widely used secure file transfer server. The flaw allows remote attackers to bypass login authentication and gain administrative access by spoofing...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...