59 matches found
CVE-2023-27163-exploit
CVE-2023-27163 — request-baskets SSRF 익스플로잇 이 익스플로잇은 request-baskets 버전 ≤ 1.2.1에서 발견된 SSRFServer-Side Request Forgery 취약점인 CVE-2023-27163 을 대상으로 작성했습니다. 이 결함은 /api/baskets/name 엔드포인트에 있으며, forwardurl 매개변수를 통해 공격자가 서버를 대신해 임의의 HTTP 요청을 보내도록 만들 수 있습니다. 작동 방식 이 익스플로잇은 내부 대상을 가리키는 forwardurl로 구성된 악성...
CVE-2021-27905
CVE-2021-27905 순번| 제목 ---|--- 1| 개요 2| 근본 원인 3| 개념 증명 4| 완화 조치 8.8.2+ 5| 참조 교육 및 연구 목적으로만 사용하세요. 소유하지 않았거나 명시적 허가를 받지 않은 시스템에서 이 코드를 사용하지 마십시오. 저는 오용에 대해 책임지지 않습니다. 개요 이는 Apache Solr /replication?command=fetchindex&masterUrl=http:// Solr 의 ReplicationHandler는 다음을 수행합니다: 1. 요청을 수락합니다. 2. 제공된...
CVE-2026-92566
DataGear through 6.0.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /dataSet/preview/Http endpoint. By supplying a caller-controlled URI, an attacker can issue GET, POST, PUT, PATCH, or DELETE requests to internal services and cloud metadata endpoints, recei...
Server-side Request Forgery (SSRF)
Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the acmeurl option during the authority update. An attacker can cause the backend to make arbitrary HTTP requests to internal or external...
CVE-2026-15732: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...
CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...
CVE-2026-0560
Summary of the vulnerability (CVE-2026-0560): In parisneo/lollms
CVE-2026-32110
SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and...
CVE-2025-56589
A Local File Inclusion LFI and a Server-Side Request Forgery SSRF vulnerability was found in the InsertFromHtmlString function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or...
CVE-2019-18394
A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests...
CVE-2022-27873
An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...
EUVD-2024-16199
Malicious code in bioql PyPI...
EUVD-2022-32361
Malicious code in bioql PyPI...
EUVD-2024-44173
Malicious code in bioql PyPI...
EUVD-2023-2851
Malicious code in bioql PyPI...
EUVD-2023-58828
Malicious code in bioql PyPI...
EUVD-2023-58628
Malicious code in bioql PyPI...
The vulnerability of the GitFlic platform, related to the lack of authentication, allows a malicious user to execute arbitrary HTTP requests on behalf of the server.
The vulnerability of the GitFlic platform’s code-related functionality lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary HTTP requests on behalf of the server...
Server-side Request Forgery (SSRF)
Overview johnbillion/wp-crontrol is a package that allows you to take control of the cron events on your WordPress website. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the wpremoterequest function. An attacker can send arbitrary HTTP requests from the...
CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...