CVE-2021-40438-POC

Note: Intended only for educational and controlled testing purposes. Only test on systems you have permission to assess. CVE-2021-40438 - SSRF Exploit ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄...

CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - Authenticated Subscriber+ Server-Side Request Forgery Description: The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Server-Side Request Forgery in...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

poc-cve-2026-32255

Kan SSRF via Attachment Download CVE-2026-32255 - Proof of Concept This repository contains a proof of concept POC for CVE-2026-32255 , a high-severity Server-Side Request Forgery SSRF vulnerability in Kan , an open-source project management tool. The vulnerable endpoint allows unauthenticated...

blind-ssrf-chains

Introduction What is Server Side Request Forgery SSRF? Server Side Request Forgery occurs when you can coerce a server to make arbitrary requests on your behalf. As the requests are being made by the server, it may be possible to access internal resources due to where the server is positioned in...

CVE-2022-25260

CVE-2022-25260 JetBrains Hub pre-auth semi-blind server-side request forgery SSRF Requirements JetBrains Hub 2021.1.14276 JetBrains Hub before 2021.1.14276 was vulneable to improper access control CVE-2022-34894, which allows an attacker create untrusted services without authentication even if...

EUVD-2026-106883

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...

CVE-2026-102923

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

EUVD-2026-102477

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

PT-2026-115846

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313

The JobOps software (versions through 0.13.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the POST /api/manual-jobs/fetch handler. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal destinations by supplying loopback, p...

CVE-2026-55875

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-55875

Helium, a student planner, is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.60 . An authenticated user can submit an arbitrary URL to the POST /feed/externalcalendars/ endpoint. The application's icalexternalcalendarservice.py script validates only the URL syntax befor...

CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-110812

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

PT-2026-115277

Name of the Vulnerable Software and Affected Versions JobOps versions prior to 0.13.2 Description A server-side request forgery SSRF issue exists in the 'POST /api/manual-jobs/fetch' endpoint. This allows authenticated users, or unauthenticated clients when the system is in demo mode, to force th...

CVE-2026-110812: Deserialization of Untrusted Data

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...