EUVD-2023-0083

Malicious code in bioql PyPI...

EUVD-2025-30331

Malicious code in bioql PyPI...

EUVD-2024-19961

Malicious code in bioql PyPI...

EUVD-2022-4181

Malicious code in bioql PyPI...

CVE-2025-59344

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344

AliasVault API <= 0.23.0 is affected by an SSRF in the favicon extraction flow. The extractor fetches a user-supplied URL, parses HTML, and follows . It validates the initial URL to HTTP(S) default ports but follows redirects and does not block loopback/internal IP ranges, allowing an authenti...

CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

PT-2025-38575

Name of the Vulnerable Software and Affected Versions AliasVault API versions 0.23.0 and lower Description A server-side request forgery SSRF vulnerability exists in the favicon extraction feature. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

GeoNode Server Side Request forgery

Summary A server side request forgery vuln was found within geonode when testing on a bug bounty program. Server side request forgery allows a user to request information on the internal service/services. Details The endpoint /proxy/?url= does not properly protect against SSRF. when using the...

SUSE CVE-2021-37939

It was discovered that Kibana's JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

BIT-WORDPRESS-2022-3590 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2024-22408

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408 Server-Side Request Forgery (SSRF) in Shopware Flow Builder

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408

Shopware Flow Builder has a URL validation issue in the call webhook action that enables SSRF to internal hosts. Affected: Shopware open headless commerce platform (Flow Builder component). Impact: potential unauthorized web requests from authenticated users to internal destinations. Remediation:...

CVE-2024-22408 Server-Side Request Forgery (SSRF) in Shopware Flow Builder

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

PT-2024-19398 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.5.7.4 Shopware version 6.4 Description: The Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to...

Shopware Code Issues Vulnerabilities

Shopware is a suite of open source e-commerce software from German company Shopware. A code issue vulnerability exists in Shopware versions 6.5.7.3 and earlier, which stems from the Flow Builder functionality not being able to adequately validate request URLs, allowing an attacker to perform web...