# CWE-348.

Every Advisory and CVE whose sources give the weakness CWE-348, newest first.

## Records, newest first (an older page)

- [Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled](https://agentprime.io/advisories/CVE-2026-44183.md)
  `CVE-2026-44183` · CVE record: Cleanuparr Cleanuparr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-348
- [systemd: In nspawn in systemd 233 through 259 before 260…](https://agentprime.io/advisories/CVE-2026-40226.md)
  `CVE-2026-40226` · CVE record: systemd systemd · CVSS 6.4 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-348
- [Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery](https://agentprime.io/advisories/CVE-2026-35391.md)
  `CVE-2026-35391` · CVE record: bulwarkmail webmail · CVSS 8.7 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-348
- [OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when \`allowRemoteViewer\` is disabled](https://agentprime.io/advisories/GHSA-3xv9-89fm-7h4r.md)
  `GHSA-3xv9-89fm-7h4r`, `CVE-2026-41403` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-348, CWE-807
- [Shynet before 0.14.0 allows Host header injection in the password reset flow.](https://agentprime.io/advisories/CVE-2026-35507.md)
  `CVE-2026-35507` · CVE record: milesmcc Shynet · CVSS 6.4 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-348
- [URL (HTTP Origin) call location spoofing in Szafir SDK Web](https://agentprime.io/advisories/CVE-2026-26927.md)
  `CVE-2026-26927` · CVE record: Krajowa Izba Rozliczeniowa Szafir SDK Web · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-348
- [AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()](https://agentprime.io/advisories/GHSA-8p2x-5cpm-qrqw.md)
  `GHSA-8p2x-5cpm-qrqw`, `CVE-2026-33690`, `PKSA-x77f-z8vb-hbfr` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-348
- [fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections](https://agentprime.io/advisories/GHSA-444r-cwp2-x5xf.md)
  `GHSA-444r-cwp2-x5xf`, `CVE-2026-3635` · npm `fastify`: affected `<5.8.3`, fixed in `5.8.3` · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-348
- [Header Poisoning in Raytha CMS](https://agentprime.io/advisories/CVE-2025-69240.md)
  `CVE-2025-69240` · CVE record: Raytha Raytha · CVSS 7.5 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-348
- [wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()](https://agentprime.io/advisories/CVE-2026-22201.md)
  `CVE-2026-22201` · CVE record: gVectors wpDiscuz · CVSS 6.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-348
- [In Meshtastic, an attacker can spoof licensed amateur flag for a node](https://agentprime.io/advisories/CVE-2025-55292.md)
  `CVE-2025-55292` · CVE record: meshtastic firmware · CVSS 8.2 High · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-348
- [Bun: In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be…](https://agentprime.io/advisories/CVE-2026-24910.md)
  `CVE-2026-24910` · CVE record: Bun Bun · CVSS 5.9 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-348
- [AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2025-13694.md)
  `CVE-2025-13694` · CVE record: aaextensions AA Block country · CVSS 5.3 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-348
- [PbootCMS Header handle.php get_user_ip less trusted source](https://agentprime.io/advisories/CVE-2025-15154.md)
  `CVE-2025-15154` · CVE record: PbootCMS · CVSS 6.9 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: CWE-348
- [KDE Connect information-exchange protocol: In the KDE Connect information-exchange protocol before 2025-04-18…](https://agentprime.io/advisories/CVE-2025-32900.md)
  `CVE-2025-32900` · CVE record: KDE KDE Connect information-exchange protocol · CVSS 4.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-348
- [Termix' official Docker image contains an authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2025-59951.md)
  `CVE-2025-59951` · CVE record: LukeGus Termix · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2025 · Tags: Broken access control, CWE-348
- [RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history.](https://agentprime.io/advisories/CVE-2025-58422.md)
  `CVE-2025-58422` · CVE record: Ricoh Company, Ltd. RICOH Streamline NX · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2025 · Tags: CWE-348
- [Movable Type contains an issue with use of less trusted source.](https://agentprime.io/advisories/CVE-2025-53522.md)
  `CVE-2025-53522` · CVE record: Six Apart Ltd. Movable Type (Software Edition) and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-348
- [Ricoh Company, Ltd. RICOH Streamline NX V3 PC Client: RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of…](https://agentprime.io/advisories/CVE-2025-48825.md)
  `CVE-2025-48825` · CVE record: Ricoh Company, Ltd. RICOH Streamline NX V3 PC Client · CVSS 2.0 Low · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-348
- [Fabio allows HTTP clients to manipulate custom headers it adds](https://agentprime.io/advisories/GHSA-q7p4-7xjv-j3wf.md)
  `GHSA-q7p4-7xjv-j3wf`, `CVE-2025-48865`, `GO-2025-3722` · Go `github.com/fabiolb/fabio`: affected `<1.6.6`, fixed in `1.6.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: CWE-345, CWE-348
- [Digital Arts Inc. i-FILTER: The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper…](https://agentprime.io/advisories/CVE-2025-47149.md)
  `CVE-2025-47149` · CVE record: Digital Arts Inc. i-FILTER · CVSS 6.9 Medium · Not analysed yet · Published 23 May 2025 · Tags: CWE-348
- [Bypass Connection Restriction Vulnerability in Hitachi Ops Center Analyzer](https://agentprime.io/advisories/CVE-2025-1245.md)
  `CVE-2025-1245` · CVE record: Hitachi Hitachi Infrastructure Analytics Advisor and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 May 2025 · Tags: CWE-348
- [Retool (self-hosted) before 3.196.0 allows Host header injection.](https://agentprime.io/advisories/CVE-2025-47424.md)
  `CVE-2025-47424` · CVE record: Retool Retool · CVSS 7.1 High · Not analysed yet · Published 9 May 2025 · Tags: CWE-348
- [SSL.com: SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used…](https://agentprime.io/advisories/CVE-2025-43918.md)
  `CVE-2025-43918` · CVE record: SSL.com SSL.com · CVSS 6.4 Medium · Not analysed yet · Published 19 Apr 2025 · Tags: CWE-348
- [Passbolt API: Passbolt API before 5, if the server is misconfigured (with an incorrect installation…](https://agentprime.io/advisories/CVE-2025-27913.md)
  `CVE-2025-27913` · CVE record: Passbolt API · CVSS 2.1 Low · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-348
- [CyberArk Privileged Access Manager: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before…](https://agentprime.io/advisories/CVE-2024-54840.md)
  `CVE-2024-54840` · CVE record: CyberArk Privileged Access Manager · CVSS 4.2 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-348
- [TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)](https://agentprime.io/advisories/GHSA-hj78-p4h7-m5fv.md)
  `GHSA-hj78-p4h7-m5fv`, `CVE-2025-24856`, `PKSA-gp2p-h8q5-v64g` · Packagist `causal/oidc`: affected `>=3.0.0, <4.0.0`, fixed in `4.0.0` · CVSS 4.2 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: Authentication bypass, Broken access control, CWE-348
- [PostgreSQL libpq retains an error message from man-in-the-middle](https://agentprime.io/advisories/CVE-2024-10977.md)
  `CVE-2024-10977` · CVE record: PostgreSQL · CVSS 3.1 Low · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-348
- [OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand](https://agentprime.io/advisories/GHSA-79jv-5226-783f.md)
  `GHSA-79jv-5226-783f`, `CVE-2024-47880` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-348
- [Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4534.md)
  `CVE-2022-4534` · CVE record: wp-buy Limit Login Attempts (Spam Protection) · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-348
- [HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik](https://agentprime.io/advisories/GHSA-62c8-mh53-4cqv.md)
  `GHSA-62c8-mh53-4cqv`, `CVE-2024-45410`, `GO-2024-3135` · Go `github.com/traefik/traefik` and 2 more: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-345, CWE-348
- [Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4533.md)
  `CVE-2022-4533` · CVE record: devfelixmoira Limit Login Attempts Plus – WordPress Limit Login Attempts By Felix · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: CWE-348
- [Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4529.md)
  `CVE-2022-4529` · CVE record: msoftplugins Security, Antivirus, Firewall – S.A.F · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2024 · Tags: CWE-348
- [Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4539.md)
  `CVE-2022-4539` · CVE record: cyberlord92 Web Application Firewall – website security · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2024 · Tags: CWE-348
- [IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4536.md)
  `CVE-2022-4536` · CVE record: youtag Two-factor authentication (formerly IP Vault) · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2024 · Tags: CWE-348
- [Serilog Client IP Spoofing vulnerability](https://agentprime.io/advisories/GHSA-5x5q-cqf6-gj8r.md)
  `GHSA-5x5q-cqf6-gj8r`, `CVE-2024-44930` · NuGet `Serilog.Enrichers.ClientInfo`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 29 Aug 2024 · Tags: Cross-site scripting (XSS), CWE-348
- [LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4532.md)
  `CVE-2022-4532` · CVE record: krut1 LOGIN AND REGISTRATION ATTEMPTS LIMIT · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2024 · Tags: CWE-348
- [Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass](https://agentprime.io/advisories/CVE-2024-6171.md)
  `CVE-2024-6171` · CVE record: unitecms Unlimited Elements For Elementor · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-348
- [WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability](https://agentprime.io/advisories/CVE-2022-44593.md)
  `CVE-2022-44593` · CVE record: SolidWP Solid Security · CVSS 3.7 Low · Not analysed yet · Published 21 Jun 2024 · Tags: CWE-348
- [WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass](https://agentprime.io/advisories/CVE-2024-0789.md)
  `CVE-2024-0789` · CVE record: florent73 WP Maintenance · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: CWE-348
- [Fortinet FortiPortal: A Use Of Less Trusted Source \[CWE-348\] vulnerability in Fortinet FortiPortal version…](https://agentprime.io/advisories/CVE-2024-23105.md)
  `CVE-2024-23105` · CVE record: Fortinet FortiPortal · CVSS 7.1 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-348
- [Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source](https://agentprime.io/advisories/CVE-2024-27773.md)
  `CVE-2024-27773` · CVE record: Unitronics Unistream Unilogic · CVSS 8.8 High · Not analysed yet · Published 18 Mar 2024 · Tags: CWE-348
- [CasaOS Gateway vulnerable to incorrect identification of source IP addresses](https://agentprime.io/advisories/GHSA-vjh7-5r6x-xh6g.md)
  `GHSA-vjh7-5r6x-xh6g`, `CVE-2023-37265`, `GO-2023-1932` · Go `github.com/IceWhaleTech/CasaOS-Gateway`: affected `<0.4.4`, fixed in `0.4.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2023 · Tags: Authentication bypass, CWE-348
- [Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2023-2897.md)
  `CVE-2023-2897` · CVE record: themefusecom Brizy – Page Builder · CVSS 3.7 Low · Not analysed yet · Published 9 Jun 2023 · Tags: CWE-348
- [Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass](https://agentprime.io/advisories/CVE-2022-4537.md)
  `CVE-2022-4537` · CVE record: johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall · CVSS 6.5 Medium · Not analysed yet · Published 9 May 2023 · Tags: CWE-348
- [Incorrect header handling in mod-wsgi](https://agentprime.io/advisories/GHSA-7527-8855-9cf8.md)
  `GHSA-7527-8855-9cf8`, `BIT-mod_wsgi-2022-2255`, `CVE-2022-2255`, `PYSEC-2022-254` · PyPI `mod-wsgi`: affected `<4.9.3`, fixed in `4.9.3` · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2022 · Tags: CWE-345, CWE-348
- [mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism](https://agentprime.io/advisories/CVE-2022-31813.md)
  `CVE-2022-31813` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · Not analysed yet · Published 8 Jun 2022 · Tags: CWE-348
- [Nimble falls back to insecure http url when fetching packages](https://agentprime.io/advisories/CVE-2021-21373.md)
  `CVE-2021-21373` · CVE record: nim-lang security · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-348
- [Nimble fails to validate certificates due to insecure httpClient defaults](https://agentprime.io/advisories/CVE-2021-21374.md)
  `CVE-2021-21374` · CVE record: nim-lang security · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-348, CWE-349, CWE-599

Newest: <https://agentprime.io/advisories/tag/cwe-348.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-348&cursor=WyIyMDI2LTA1LTE5VDEzOjMzOjA4LjgyNTAwMFoiLCJDVkUtMjAyNi00MzYzNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-348/?cursor=WyIyMDI2LTA1LTE5VDEzOjMzOjA4LjgyNTAwMFoiLCJDVkUtMjAyNi00MzYzNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.