CWE-348: Use of Less Trusted Source
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- sensiolabs symfony Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request 2.3 Low
- umputun remark42 Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment 6.5 Medium
- mayswind ezbookkeeping ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header 5.3 Medium
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port No score - pipeshub-ai PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header 6.9 Medium
- labstack echo Echo: X-Real-IP extractor trusts the header value instead of the sending peer 5.3 Medium
- gitlab Use of Less Trusted Source in GitLab 4.3 Medium
- progressive robot ltd hmailserver Use of Less Trusted Source in hMailServer 5.9 Medium
- go-chi chi Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For 6.3 Medium
- progressive robot ltd hmailserver Use of Less Trusted Source in hMailServer 7.5 High
- coder Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header 6.3 Medium
- wheels Wheels through 4.1.1 derives its default production error-email address from the Host header of... 5.9 Medium
- wheels Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test... 6.5 Medium
- eclipse foundation connected services platform In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver... 6.5 Medium
- znuny In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain... 9.5 Critical
- alexjustesen speedtest-tracker Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing 6.3 Medium
- schlagmichdoch pairdrop PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header 2.3 Low
- smp46 pingvin-share-x Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL 6.9 Medium
- smp46 pingvin-share-x Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For 6.9 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use... 3.7 Low
- gophish Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing 6.9 Medium
- irdeto denuvo anti-tamper Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID... 1.9 Low
- pecee simple-router simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers 6.9 Medium
- unopim UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host 2.3 Low
- trusted domain project opendkim Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source 6.9 Medium
- jpadilla pyjwt PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion 6.5 Medium
- vllm vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation 8.3 High
- tomdever wpforo forum wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass 5.3 Medium
- openstack zaqar In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending... 9.2 Critical
- gitlab Use of Less Trusted Source in GitLab 4.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 more Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust 4.3 Medium
- unknown forminator forms Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing 5.3 Medium
- fabiolb fabio Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header 5.8 Medium
- kcp-dev kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace 9.9 Critical
- djust-org djust djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path 6.3 Medium
- @fastify/proxy-addr @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet 9.1 Critical
- proxy-addr proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet 9.1 Critical
- forgejo Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue... 4.3 Medium
- paytr payment and electronic money institution inc. virtual pos iframe api whmcs module Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module 9.1 Critical
- @clerk fastify fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count 6.1 Medium
- tryghost ghost-cli Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header 6.3 Medium
- codeigniter4 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() 4.8 Medium
- nlnet labs unbound 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL 6.3 Medium
- glanceapp glance Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass 8.2 High
- vastsa filecodebox FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers 8.7 High
- eclipse kura, the eclipse foundation eclipse kura +1 more Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the... 8.8 High
- decolua 9router 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF 8.2 High
- nesquena hermes-webui Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing 9.3 Critical
- hono Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication 4.8 Medium
- openbsd openssh In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over... 5.9 Medium
- Show olderLoading…