Skip to content
OpenAdvisories

Product · TarsCloud

TarsWeb

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-80349

    TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

    TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request…

    TarsCloud TarsWeb