CVE-2026-108736

Speedtest Tracker versions through 1.15.0 are vulnerable to an IP allowlist bypass due to improper handling of the X-Forwarded-For header. The application's bootstrap/app.php file incorrectly trusts every peer as a proxy, allowing unauthenticated remote attackers to spoof headers to evade ALLOWED...

EUVD-2026-96902

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

fockcache

fockcache FockCache - Test di Cache Poisoning Minimizzato Dettagli sul Cache Poisoning : https://portswigger.net/research/practical-web-cache-poisoning FockCache FockCache cerca di effettuare cache poisoning provando gli header X-Forwarded-Host e X-Forwarded-Scheme sulle pagine web. Dopo un...

requests-ip-rotator

Orgogliosamente sponsorizzato da Swiftproxy Proxy residenziali ad alte prestazioni con un pool di oltre 80 milioni di IP in più di 195 paesi — migliora il tasso di successo delle richieste e riduce i blocchi IP durante la raccolta di dati su larga scala e l'automazione del browser. Perfetto per...

CVE-2026-108522

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108522 Studio-Saelix Sencho Login Endpoint login improper authentication

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

EUVD-2026-96729

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108522

The Studio-Saelix Sencho software (up to version 0.94.1 ) contains a vulnerability in the Login Endpoint (specifically affecting the /api/auth/login file). The root cause is that the login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing ...

transfer.sh

AVVISO DI SICUREZZA Bypass del filtro IP e dell'autenticazione HTTP tramite spoofing dell'header X-Forwarded-For non autenticato transfer.sh Condivisione di file facile e veloce dalla riga di comando. Questo codice contiene il server con tutto il necessario per creare la tua istanza. Transfer.sh...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

CVE-2022-46169

CVE-2022-46169 Cacti Blinde Remote Code Execution Pre-Auth Haftungsausschluss Dies dient nur zu Bildungszwecken. Ich bin nicht für deine Handlungen verantwortlich. Benutzung auf eigene Gefahr. Erklärung Dieses Skript brute-forcet die Variablen, die zum Ausnutzen dieser Schwachstelle erforderlich...

CVE-2022-4539

Nutzungshinweise: Anpassungsfähigkeit: Sie können die Payloads, die IP-Generierungslogik und die Proxys einfach ändern, um sie an verschiedene Szenarien oder Umgebungen anzupassen. Ethische Nutzung: Stellen Sie sicher, dass Sie die ausdrückliche Erlaubnis haben, bevor Sie ein System mit diesem Co...

CVE-2025-48799-

CVE-2025-48799 – Apache Tomcat Remotecodeausführung PoC Dieses Repository enthält einen Proof-of-Concept-Exploit für CVE-2025-48799, eine Schwachstelle zur Remotecodeausführung, die in Apache Tomcat 9.0.48 entdeckt wurde. Der Fehler beruht auf einem Integerüberlauf im HTTP-Header-Parser, der durc...

CVE-2015-3224

Ruby on Rails Web Console Exploit CVE-2015-3224 Questo repository contiene uno script Python per sfruttare una vulnerabilità di bypass della whitelist IP nella console di sviluppo web di Ruby on Rails 4.0.x e 4.1.x. Lo script consente l'esecuzione remota di comandi su server vulnerabili. ⚠️...

fireprox

FireProx Panoramica Vantaggi Avvertenze Manutentore Crediti Utilizzo Base Installazione Screenshot Contribuire Panoramica Potere nascondere o ruotare continuamente l'indirizzo IP di origine quando si effettuano chiamate web può essere difficile o costoso. Esistono diversi strumenti da tempo, ma...

CVE-2024-41276

CVE-2024-41276 Bypass dell'autenticazione Kaiten Kaiten - un sistema di gestione dei flussi di lavoro. Una vulnerabilità in Kaiten consente agli attaccanti di bypassare il meccanismo di autenticazione tramite PIN. L'applicazione richiede agli utenti di inserire un PIN di 6 cifre inviato via email...

CVE-2026-108162

Pingvin Share X versions before 1.22.0 are vulnerable to a rate limit bypass because the application's backend/src/main.ts unconditionally trusts proxy headers. This allows unauthenticated remote attackers to evade per-IP throttling by rotating spoofed X-Forwarded-For values. Attackers can target...

EUVD-2026-96317

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...