sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC This Python script is a proof-of-concept PoC for executing SSRF Server-Side Request Forgery and Timing Attacks against SAP BusinessObjects Launchpad. It is designed to help security researchers and professionals identify open ports on a targe...

CVE-2026-101027

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

EUVD-2026-93908

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-101027 Gitea migration SSRF through ALLOWED_DOMAINS address check bypass

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-105762

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

PT-2026-107129

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw exists when the migrations ALLOWED DOMAINS configuration is active. The system accepts hostnames matching the allow list without verifying if the resolved address violates local-network...

CVE-2026-105762

The open-source LLM app development platform Dify is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /console/api/remote-files/upload endpoint within api/controllers/web/remote_files.py. The vulnerability exists because the application accepts attacker-controlled URLs w...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105743

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validateurlsafety in docling/backend/utils/imageresourceloader.py validates a hostname with a single IPv4 lookup and then allows the HTTP clien...

CVE-2026-105743 Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validateurlsafety in docling/backend/utils/imageresourceloader.py validates a hostname with a single IPv4 lookup and then allows the HTTP clien...

CVE-2026-105743 Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validateurlsafety in docling/backend/utils/imageresourceloader.py validates a hostname with a single IPv4 lookup and then allows the HTTP clien...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Неаутентифицированная Server-Side Request Forgery Описание Плагин Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player для WordPress уязвим к Server-Side Request Forgery во всех версиях до 2.0.82 включительно. Это позволяет неаутентифицированны...

PT-2026-106246

Name of the Vulnerable Software and Affected Versions Docling versions 2.91.0 through 2.131.0 Description The validate url safety function in docling/backend/utils/image resource loader.py performs a single IPv4 lookup to validate a hostname but subsequently allows the HTTP client to resolve and...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2026-63642

SSRF в модуле календаря MagicMirror² Доказательство концепции эксплуатации для CVE-2026-63642 и CVE-2026-63643 — уязвимостей Server-Side Request Forgery в модуле Calendar MagicMirror², которые позволяют любому неаутентифицированному атакующему заставить сервер выполнять произвольные HTTP-запросы ...

CVE-2023-27163

CVE-2023-27163 Это PoC для CVE-2023-27163 — уязвимости SSRF, присутствующей в request-baskets вплоть до v1.2.1. Эта уязвимость позволяет злоумышленникам получать доступ к чувствительным сетевым ресурсам через /api/baskets/name. request-baskets содержит функциональность, позволяющую пользователю...