CVE-2025-31033

⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin Exploit – CVE-2025-31033 form action="http://target.com/wp-admin/admin.php?page=bph-settings" me...

cve-2016-4845_csrf

cve-2016-4845csrf Proof of concept for CSRF vulnerabilityCVE-2016-4825 on IO-DATA Recording Hard Disc Drive. License These codes are released under the MIT License. Please see LICENSE.txt...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 CSRF Vulnerability: Leads to Creating Fake Clients Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/ Vulnerability Name : Cross-Site Request ForgeryCSRF Affected Version : V1.2 Introduction A Cross-Site Request Forgery CSRF vulnerability...

CVE-2026-115813

The Amazon Web Services Multi Model Server (version 1.1.11 and earlier ) is vulnerable to a Server-Side Request Forgery (SSRF) in the model download path. This flaw allows remote actors to send requests to internal network destinations by providing a crafted model URL . Because the software is en...

CVE-2026-115813 Server-side request forgery in the model download path in Amazon Web Services Multi Model Server

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users shoul...

EUVD-2026-109112

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users shoul...

CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc history.pushState'', '', '/' Success:...

CVE-2020-23588

CVE-2020-23588 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" allows an unauthenticated, remote attacker to conduct a cross-sit...

cve-2026-102268-poc

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass Exploitability analysis result: the root cause is confirmed and end-to-end exploitation is reproducible. A whitespace-mutated PEM public key bypasses PyJWT's ispemformat guard and is accepted as a valid HMAC secret, enabling full HS256 token...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

XenServer Security Update for CVE-2026-114406

Severity: High Description of Problem XenServer's internal list of trusted certificate authorities CAsincluded apublic CA whose intermediate certificateshave been found to haveweak keys. This would allow a malicious attacker on the management network to forge TLScertificatesthat appeared to be...

SSRF-CVE-2018-25031-

This repository does not have a README...

CVE-2026-93631

A cross-site request forgery (CSRF) vulnerability exists in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition versions 10.1.16 and 10.1.20 . The flaw stems from the OAuth callback failing to bind its state value or authorization code to the initiating Zimbra session, instead...

EUVD-2026-108972

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-115752

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC for CVE-2021-22214: Gitlab SSRF Description The remote GitLab install contains a Server-side request forgery SSRF vulnerability as a result of the internal network for webhooks being enabled. A remote, unauthenticated attacker can exploit a registration-limited GitLab instance...

EUVD-2026-108960

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud...

EUVD-2026-108959

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

EUVD-2026-108940

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...