CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml The essence of this vulnerability is similar to CVE-2021-45232, both bypass authorization or are unauthenticated, to execute malicious filterfunc or script in a route to execute commands...

vaultwarden-ip-header-spoof

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vaultwarden-ip-header-spoof vaultwarden-ip-header-spoof Vaultwarden 1.37.3 - dani-garcia Default IPHEADER=X-Real-IP plus IPHEADERTRUSTEDPROXIES=local treats any non-global TCP peer as a reverse proxy. Stock Docker...

CVE-2026-116254

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

CVE-2026-116254 rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

EUVD-2026-109707

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

CVE-2026-116254

A vulnerability exists in rathena FluxCP (up to version 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d) affecting the PayPal IPN Handler component. Specifically, the verifyiprange function in lib/Flux/PaymentNotifyRequest.php is susceptible to an origin validation error due to the manipulation of the X...

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Impact In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP with the...

CVE-2026-113507

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and cou...

EUVD-2026-105215

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-113507 aaPanel common.py GetClientIp access control

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-113507

The software aaPanel (up to version 8.25.0 ) contains an improper access control vulnerability in the GetClientIp function located within class/public/common.py. The root cause is the improper handling of the X-Real-Ip argument, which can be manipulated by a remote attacker to bypass security con...

PT-2026-118580

Name of the Vulnerable Software and Affected Versions aaPanel versions prior to 8.25.0 Description Remote improper access controls occur due to the manipulation of the X-Real-Ip argument within the GetClientIp function located in the class/public/common.py file. Recommendations Update aaPanel to...

CVE-2026-107271

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

EUVD-2026-94402

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107271

Gophish versions through 0.12.1 are vulnerable to a rate limit bypass in the /login endpoint. The root cause is the improper handling of X-Forwarded-For or X-Real-IP headers, which allows unauthenticated attackers to spoof their source IP address with each request. Because the rate limiter keys o...

PT-2026-107575

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107271: Use of Less Trusted Source

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...