Advisories · Weakness
CWE-348.
Every Advisory and CVE whose sources give the weakness CWE-348, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled
- Cleanuparr
- Authentication bypass
- CWE-348
- CVSS 6.4 Medium
systemd: In nspawn in systemd 233 through 259 before 260…
- systemd
- CWE-348
- CVSS 8.7 High
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery
- bulwarkmail webmail
- CWE-348
- CVSS 6.3 Medium
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled
- CWE-348
- CWE-807
<2026.3.31 · fixed in 2026.3.31
GHSA-3xv9-89fm-7h4r · CVE-2026-41403 - CVSS 6.4 Medium
Shynet before 0.14.0 allows Host header injection in the password reset flow.
- milesmcc Shynet
- CWE-348
- CVSS 5.1 Medium
URL (HTTP Origin) call location spoofing in Szafir SDK Web
- Krajowa Izba Rozliczeniowa Szafir SDK Web
- CWE-348
- CVSS 5.3 Medium
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
- CWE-348
<=26.0 · no fixed version yet
GHSA-8p2x-5cpm-qrqw · CVE-2026-33690 - CVSS 6.1 Medium
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
- CWE-348
<5.8.3 · fixed in 5.8.3
GHSA-444r-cwp2-x5xf · CVE-2026-3635 - CVSS 7.5 High
Header Poisoning in Raytha CMS
- Raytha
- CWE-348
- CVSS 6.9 Medium
wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
- gVectors wpDiscuz
- CWE-348
- CVSS 8.2 High
In Meshtastic, an attacker can spoof licensed amateur flag for a node
- meshtastic firmware
- CWE-348
- CVSS 5.9 Medium
Bun: In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be…
- Bun
- CWE-348
- CVSS 5.3 Medium
AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header
- aaextensions AA Block country
- CWE-348
- CVSS 6.9 Medium
PbootCMS Header handle.php get_user_ip less trusted source
- PbootCMS
- CWE-348
- CVSS 4.3 Medium
KDE Connect information-exchange protocol: In the KDE Connect information-exchange protocol before 2025-04-18…
- KDE Connect information-exchange protocol
- CWE-348
- CVSS 9.2 CriticalCritical · CVSS 9+
Termix' official Docker image contains an authentication bypass vulnerability
- LukeGus Termix
- Broken access control
- CWE-348
- CVSS 2.3 Low
RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history.
- Ricoh Company, Ltd. RICOH Streamline NX
- CWE-348
- CVSS 6.9 Medium
Movable Type contains an issue with use of less trusted source.
- Six Apart Ltd. Movable Type (Software Edition)
- Six Apart Ltd. Movable Type Advanced (Software Edition)
- CWE-348
- CVSS 2.0 Low
Ricoh Company, Ltd. RICOH Streamline NX V3 PC Client: RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of…
- Ricoh Company, Ltd. RICOH Streamline NX V3 PC Client
- CWE-348
- CVSS 9.1 CriticalCritical · CVSS 9+
Fabio allows HTTP clients to manipulate custom headers it adds
- CWE-345
- CWE-348
<1.6.6 · fixed in 1.6.6
GHSA-q7p4-7xjv-j3wf · CVE-2025-48865 - CVSS 6.9 Medium
Digital Arts Inc. i-FILTER: The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper…
- Digital Arts Inc. i-FILTER
- CWE-348
- CVSS 6.5 Medium
Bypass Connection Restriction Vulnerability in Hitachi Ops Center Analyzer
- Hitachi Infrastructure Analytics Advisor
- Hitachi Ops Center Analyzer
- CWE-348
- CVSS 7.1 High
Retool (self-hosted) before 3.196.0 allows Host header injection.
- Retool
- CWE-348
- CVSS 6.4 Medium
SSL.com: SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used…
- SSL.com
- CWE-348
- CVSS 2.1 Low
Passbolt API: Passbolt API before 5, if the server is misconfigured (with an incorrect installation…
- Passbolt API
- CWE-348
- CVSS 4.2 Medium
CyberArk Privileged Access Manager: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before…
- CyberArk Privileged Access Manager
- CWE-348
- CVSS 4.2 Medium
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
- Authentication bypass
- Broken access control
>=3.0.0, <4.0.0 · fixed in 4.0.0
GHSA-hj78-p4h7-m5fv · CVE-2025-24856 - CVSS 3.1 Low
PostgreSQL libpq retains an error message from man-in-the-middle
- PostgreSQL
- CWE-348
- CVSS 8.1 High
OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand
- Cross-site scripting (XSS)
- CWE-348
<3.8.3 · fixed in 3.8.3
GHSA-79jv-5226-783f · CVE-2024-47880 - CVSS 5.3 Medium
Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass
- wp-buy Limit Login Attempts (Spam Protection)
- CWE-348
- CVSS 9.8 CriticalCritical · CVSS 9+
HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik
- CWE-345
- CWE-348
* · no fixed version yet
GHSA-62c8-mh53-4cqv · CVE-2024-45410 - CVSS 5.3 Medium
Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass
- devfelixmoira Limit Login Attempts Plus – WordPress Limit Login Attempts By Felix
- CWE-348
- CVSS 5.3 Medium
Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass
- msoftplugins Security, Antivirus, Firewall – S.A.F
- CWE-348
- CVSS 5.3 Medium
Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
- cyberlord92 Web Application Firewall – website security
- CWE-348
- CVSS 5.3 Medium
IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass
- youtag Two-factor authentication (formerly IP Vault)
- CWE-348
- CVSS 6.5 Medium
Serilog Client IP Spoofing vulnerability
- Cross-site scripting (XSS)
- CWE-348
<2.1.0 · fixed in 2.1.0
GHSA-5x5q-cqf6-gj8r · CVE-2024-44930 - CVSS 6.5 Medium
LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass
- krut1 LOGIN AND REGISTRATION ATTEMPTS LIMIT
- CWE-348
- CVSS 5.3 Medium
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass
- unitecms Unlimited Elements For Elementor
- CWE-348
- CVSS 3.7 Low
WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability
- SolidWP Solid Security
- CWE-348
- CVSS 5.3 Medium
WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass
- florent73 WP Maintenance
- CWE-348
- CVSS 7.1 High
Fortinet FortiPortal: A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version…
- Fortinet FortiPortal
- CWE-348
- CVSS 8.8 High
Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source
- Unitronics Unistream Unilogic
- CWE-348
- CVSS 9.8 CriticalCritical · CVSS 9+
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
- Authentication bypass
- CWE-348
<0.4.4 · fixed in 0.4.4
GHSA-vjh7-5r6x-xh6g · CVE-2023-37265 - CVSS 3.7 Low
Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
- themefusecom Brizy – Page Builder
- CWE-348
- CVSS 6.5 Medium
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
- johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall
- CWE-348
- CVSS 7.5 High
Incorrect header handling in mod-wsgi
- CWE-345
- CWE-348
<4.9.3 · fixed in 4.9.3
GHSA-7527-8855-9cf8 · CVE-2022-2255 -
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
- Apache Software Foundation Apache HTTP Server
- CWE-348
- CVSS 7.5 High
Nimble falls back to insecure http url when fetching packages
- nim-lang security
- CWE-348
- CVSS 8.1 High
Nimble fails to validate certificates due to insecure httpClient defaults
- nim-lang security
- CWE-348
- CWE-349