CVE-2025-60541: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request...

CVE-2025-61784

LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure ...

EUVD-2018-1856

Malware in sbrugna...

EUVD-2023-2052

Malicious code in bioql PyPI...

EUVD-2024-49313

Malicious code in bioql PyPI...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted requests to internal or protected endpoints. Note: This is only exploitabl...

Server-side Request Forgery (SSRF)

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted...

CVE-2025-34231

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a blind and non-blind server-side request forgery SSRF vulnerability. The '/var/www/app/consolerelease/hp/badgeSetup.php' script is reachable...

CVE-2025-34228

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a server-side request forgery SSRF vulnerability. The /var/www/app/consolerelease/lexmark/update.php script is reachable from the internet...

CVE-2025-34225

Vasion Print (PrinterLogic) Virtual Appliance Host before 25.1.102 and Application before 25.1.1413 suffer SSRF via an unauthenticated console_release directory. Dozens of PHP scripts build URLs from user-controlled input and invoke curl_exec() or file_get_contents() without sufficient validation...

CVE-2025-9862

Server-Side Request Forgery SSRF vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3...

CVE-2025-37125

CVE-2025-37125 affects HPE Aruba Networking EdgeConnect OS (ECOS). The issue is described as a broken access control that could allow bypassing firewall protections and improper handling of unauthorized traffic. Connected sources corroborate ECOS involvement and reference public advisories; some ...

php: Configuring a proxy in a stream context might allow for CRLF injection in URIs

A flaw was found in PHP. In affected versions of PHP, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL validation process. An attacker can access internal or otherwise restricted resources by submitting a specially crafted URL that bypasses configured allowlists. Remediation Upgrade...

PT-2025-27409 · Apache · Apache Eventmesh

Name of the Vulnerable Software and Affected Versions: Apache EventMesh versions prior to 1.12.0 Description: This issue is a Server-Side Request Forgery SSRF within the eventmesh-runtime module, specifically in the WebhookUtil.java file, affecting Windows, Linux, and macOS operating systems. The...

Server-side Request Forgery (SSRF)

Overview langchain is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the RequestsToolkit module. An attacker can access internal network resources, perform port scans, retrieve sensitive metadata fro...

CVE-2024-34711 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

CVE-2022-45429

Some Dahua software products have a vulnerability of server-side request forgery SSRF. An Attacker can access internal resources by concatenating links URL that conform to specific rules...

CVE-2025-47936

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery CSRF, which can be exploited by adversaries to target internal resources...

CVE-2018-1000138

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources...