diao111111/cve-2026-37432Proof-of-concept exploit for CVE-2026-37432: IP address spoofing via forged X-Forwarded-For header in Java web applications, targeting Apiutil.java.
Location: Apiutil.java: 107-113
Principle: Directly trusting the X-Forwarded-For request header, which can be forged to manipulate IP addresses.
Exploitation method: X-Forwarded-For: 127.0.0.1
