WordPress <= 6.2 - Server Side Request Forgery

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. id: CVE-2022-3590 info: name: WordPress = 6.2 - Server Side...

Keycloak-12.0.1-CVE-2020-10770

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requesturi' 블라인드 서버 사이드 요청 위조 SSRF 인증되지 않음 Exploit-DB-50405 예상 결과: 로컬호스트 또는 내부 접근 가능 호스트의 포트 스캔 교육 및 기업 환경에서의 테스트 목적으로만 사용하세요. 이 익스플로잇은 Python 3.8.6에서 테스트되었습니다. 취약한 애플리케이션: docker run -p 9990:9990 -p 8080:8080 -e KEYCLOAKUSER=admin -e...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104464

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to force the server to make GET requests by providing an unvalidated actor URL within the Bazar abonnements sync action. Exploitation enables attackers ...

EUVD-2026-91475

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

CVE-2026-103287

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

EUVD-2026-90680

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-103287

Ghost versions 1.18.0 before 6.27.0 are vulnerable to a Server-Side Request Forgery (SSRF) in the webhooks feature. This flaw allows users with staff privileges to craft malicious webhook requests, enabling them to probe internal hosts and access internal network resources from the Ghost server. ...

CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-101057

The utcp-mcp plugin (part of python-utcp ) versions through 1.1.2 is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a lack of ensure_secure_url validation when connecting to HTTP or WebSocket MCP server URLs provided in a call template's mcpServers configuration. This bypass...

PT-2026-99101

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3 Description An issue exists in the URLValidator.validateURL function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to...

CVE-2026-62282

OpenCVE , a vulnerability intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in its notification testing feature for Webhook and Slack integrations . Prior to 3.0.0 , user-supplied HTTP/HTTPS destinations are not sufficiently validated, allowing an authenticated user with ...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-76559: Server-Side Request Forgery (SSRF)

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

PT-2026-93284

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-91967

AVideo through 29.0 contains a blind server-side request forgery (SSRF) vulnerability in the getHeaderContentTypeFromURL function, which issues get_headers() calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, trigg...