GeoNetwork - Server-Side Request Forgery (SSRF)

GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery SSRF in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any...

poc-cve-2026-32255

Kan SSRF via Attachment Download CVE-2026-32255 - Proof of Concept This repository contains a proof of concept POC for CVE-2026-32255 , a high-severity Server-Side Request Forgery SSRF vulnerability in Kan , an open-source project management tool. The vulnerable endpoint allows unauthenticated...

blind-ssrf-chains

Introduction What is Server Side Request Forgery SSRF? Server Side Request Forgery occurs when you can coerce a server to make arbitrary requests on your behalf. As the requests are being made by the server, it may be possible to access internal resources due to where the server is positioned in...

CVE-2022-25260

CVE-2022-25260 JetBrains Hub pre-auth semi-blind server-side request forgery SSRF Requirements JetBrains Hub 2021.1.14276 JetBrains Hub before 2021.1.14276 was vulneable to improper access control CVE-2022-34894, which allows an attacker create untrusted services without authentication even if...

CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - Authenticated Subscriber+ Server-Side Request Forgery Description: The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Server-Side Request Forgery in...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

CVE-2021-40438-POC

Note: Intended only for educational and controlled testing purposes. Only test on systems you have permission to assess. CVE-2021-40438 - SSRF Exploit ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄...

EUVD-2026-120455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-123818

The LMDeploy toolkit, used for deploying and serving large language models, is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.12.3 through 0.14.x . The vulnerability stems from a logical flaw in the _is_safe_url function, where urlparse and requests.Session().get interpret backsla...

CVE-2026-56712 Replicate Cog through 0.23.1 SSRF via cog.File and cog.Path URL Inputs

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP befor...

CVE-2026-49951

RAGFlow versions before 0.27.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the set_api_key() function located in api/apps/llm_app.py. Authenticated attackers can exploit this by providing an unvalidated base_url parameter to the POST /v1/llm/set_api_key endpoint. This allows at...

CVE-2026-49951 RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-71901

A flaw was found in Apache OFBiz. An authenticated user with access to the Sales Force Automation SFA component can override the service parameter invoked during a vCard file import. This flaw allows an attacker to execute unauthorized internal services, potentially exposing or modifying sensitiv...

CVE-2026-69137

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow...

CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it...

CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it...

CVE-2026-57566

The Readest ebook reader (versions prior to 0.11.10 ) contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /api/opds/proxy route. The application fails to restrict URL schemes or block private, loopback, link-local, or metadata hosts when fetching attacker-controlle...

CVE-2026-97693

The Yuxi platform (versions 0.6.0.beta1 through 0.7.1) suffers from an isolation failure between Docker sandboxes and trusted application services. A low-privileged authenticated user can bypass sandbox boundaries to access other tenants' APIs, files, and secrets, or manipulate the unauthenticate...

CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...