CVE-2025-60541

A Server-Side Request Forgery SSRF in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request...

CVE-2025-60541

A Server-Side Request Forgery SSRF in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request...

CVE-2025-60541

The linshenkx prompt-optimizer software (versions 1.3.0 through 1.4.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) within the /api/proxy/ component. An attacker can exploit this vulnerability by sending a specially crafted request to the /api/proxy endpoint, which allows them to scan i...

CVE-2025-60541: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request...

CVE-2025-43995

Dell Storage Center - Dell Storage Manager, versions 20.1.21, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An...

EUVD-2025-3151

Malicious code in bioql PyPI...

EUVD-2023-3268

Malicious code in bioql PyPI...

Papermark security vulnerability

Papermark is a document analysis software by Marc Seitz, an individual developer. A security vulnerability exists in Papermark 0.20.0 and prior versions, which stems from improperly restricting access via the POST /api/file/s3/get-presigned-get-url-proxy API, which could allow an authenticated...

CVE-2025-9805: Server-Side Request Forgery (SSRF)

A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/app/api/proxy/image/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit...

Deepin dde-api-proxy Root Privilege

The vulnerability of the dde-api-proxy component in the Deepin operating system is related to insufficient verification of the source of the communication channel. Exploiting this vulnerability can allow an attacker to gain root privileges...

CVE-2024-12766

parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the "POST /api/proxy" REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...

CVE-2024-12766: Server-Side Request Forgery (SSRF)

parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the POST /api/proxy REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...

PT-2025-12144

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V13 feather Description The issue is a Server-Side Request Forgery SSRF vulnerability in the "POST /api/proxy" REST API. Attackers can exploit this to access unauthorized web resources by specifying the JSON...

dde-api-proxy security vulnerability

dde-api-proxy is a proxy program from Deepin open source. A security vulnerability exists in dde-api-proxy version 1.0.19, which stems from the fact that an unprivileged user can access the D-Bus service as root...

CVE-2025-23222

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2025-23222: Improper Verification of Source of a Communication Channel

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2025-23222

Deepin dde-api-proxy (v1.0.19 and earlier) exposes a local privilege-escalation flaw: the daemon runs as root and forwards local user D-Bus requests to legacy D-Bus services, which do not detect the proxy context. This can allow unprivileged users to access D-Bus methods that should be restricted...

CVE-2025-23222

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2024-47066

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in "src/app/api/proxy/route.ts" does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

CVE-2024-47066: Server-Side Request Forgery (SSRF)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...