CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept exploit for CVE-2026-63642 and CVE-2026-63643, Server-Side Request Forgery vulnerabilities in MagicMirror²'s Calendar module that allow any unauthenticated attacker to force the server to make arbitrary HTTP requests to internal services...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2023-27163

CVE-2023-27163 This is a PoC for CVE-2023-27163 which is a SSRF vulnerability present in request-baskets upto v1.2.1. This vulnerability allows attackers to access sensitive network resources via /api/baskets/name. The request-baskets contains a functionality where a user can specify another serv...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Unauthenticated Server-Side Request Forgery Description The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC This Python script is a proof-of-concept PoC for executing SSRF Server-Side Request Forgery and Timing Attacks against SAP BusinessObjects Launchpad. It is designed to help security researchers and professionals identify open ports on a targe...

DEBIAN-CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-113688

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information...

CVE-2026-113688 Server-Side Request Forgery in BMC ITSM SmartIT

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information...

CVE-2026-118989

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous "POST /forms/formId/submissions" endpoint stores attacker-controlled "JsonData" after checking only that the JSON is well formed. A file object with "name", "type" and "content" fields...

CVE-2026-61529: Server-Side Request Forgery (SSRF)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590

A wide range of Harbor versions are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of validation on webhook target addresses. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event trig...

PT-2026-123023

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-55190

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...

EUVD-2026-108748

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...