CVE-2022-25260

CVE-2022-25260 JetBrains Hub 인증 전 세미 블라인드 SSRF서버 사이드 요청 위조 요구 사항 JetBrains Hub 2021.1.14276 2021.1.14276 이전의 JetBrains Hub는 부적절한 접근 제어CVE-2022-34894에 취약하여, 게스트 사용자가 비활성화되어 있어도 공격자가 인증 없이 신뢰할 수 없는 서비스를 생성할 수 있었습니다. 이로 인해 별도의 요구 사항 없이도 취약점을 악용할 수 있습니다일반적으로 공격자는 최소한 인증된 상태여야 합니다. 사용법 설치 및 실행: $ git...

blind-ssrf-chains

소개 서버 측 요청 위조SSRF란? 서버 측 요청 위조는 서버를 강제로 대신 임의의 요청을 보내도록 할 때 발생합니다. 요청이 서버에 의해 이루어지기 때문에 서버가 네트워크 상에 위치한 곳에 따라 내부 리소스에 접근할 수 있을 수 있습니다. 클라우드 환경에서는 민감한 자격 증명이나 비밀을 포함할 수 있는 메타데이터 엔드포인트의 존재로 인해 SSRF가 더 큰 위험을 제기합니다. 블라인드 SSRF 서버 측 요청 위조를 익스플로잇할 때 응답을 읽을 수 없는 상황에 자주 처하게 됩니다. 업계에서는 이러한 동작을 '블라인드 SSRF'라...

poc-cve-2026-32255

添付ファイルダウンロード経由のKan SSRF（CVE-2026-32255）- 概念実証 このリポジトリには、オープンソースのプロジェクト管理ツールであるKanにおける高深刻度のサーバーサイドリクエストフォージェリ（SSRF）脆弱性である CVE-2026-32255の 概念実証（POC）が含まれています。 この脆弱性のあるエンドポイントにより、認証されていない攻撃者がサーバーから任意のHTTPリクエストを送信し、完全なレスポンスを読み取ることができ、内部サービスやクラウドメタデータエンドポイントへのアクセスが可能になります。 目次 1. 脆弱性の詳細 2. POCの実行 3...

CVE-2026-102150

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2026-102150

A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2021-40438-POC

참고: 교육 및 통제된 테스트 목적으로만 사용하세요. 평가 권한이 있는 시스템에서만 테스트하세요. CVE-2021-40438 - SSRF 익스플로잇 ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄ ░▀▀▀░░▀░░▀▀▀░░░░░▀▀▀░░▀░░▀▀▀░▀▀▀░░░░░░░▀░░▀░░░░▀░▀▀░░░▀░ 사용법 기본 사용법 python3 exploit.py...

EUVD-2026-87979

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - 인증된 구독자+ 서버사이드 요청 위조 설명: WordPress용 Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library 플러그인은 1.2.1을 포함한 모든 버전에서 서버사이드 요청 위조Server-Side Request Forgery에 취약합니다. 이를 통해 구독자 수준 이상의 접근 권한을 가진 인증된...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. 설정 및 빌드 make setup make build 2. 서비스 시작 make up 3. 웹 접속 open http://localhost:8080 목표 내부 Admin 서비스3003번 포트에 접근하여 플래그를 획득하세요! Expected Flag : CTFflagreadme 익스플로잇 cd exploits python3 exploitgenerator.py payloads/adminflag.docx 파일을 웹에서 업로드 Based o...

CVE-2026-101048: Incorrect Authorization

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-100601

The ClawHub (openclaw/clawhub) application/backend is vulnerable to server-side request forgery (SSRF) within the public profile preview's image fetching functionality. The application accepts a user-supplied image URL and validates the textual hostname against private-address patterns but fails ...

EUVD-2026-87541

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

PT-2026-98948

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description During federated authentication OAuth, OIDC, or SAML, the system fetches a profile image URL from an external identity provider without verifying the target address. An actor with control over their...