CVE-2025-25785: Server-Side Request Forgery (SSRF)

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

PT-2025-8710

Name of the Vulnerable Software and Affected Versions JizhiCMS version 2.5.4 Description The issue is related to a Server-Side Request Forgery SSRF in the PluginsController.php component. This allows attackers to perform an intranet scan by sending a crafted request. Recommendations For JizhiCMS...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25785

JizhiCMS version v2.5.4 contains a Server-Side Request Forgery (SSRF) vulnerability within the PluginsController.php component. This flaw allows an attacker to perform an intranet scan by sending a crafted request. Practical impact includes unauthorized internal network discovery. As a temporary ...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

JIZHICMS 安全漏洞

JIZHICMS Jizhi CMS is an open source content management system CMS from China Jizhi JIZHI. A security vulnerability exists in JIZHICMS version v2.5.4, which stems from a server-side request forgery in the cPluginsController.php component that allows an attacker to perform an intranet scan...

lanproxy 安全漏洞

lanproxy is an intranet penetration tool for proxying LAN PCs and servers to the public network by ffay's personal developer. A security vulnerability exists in lanproxy v.0.1 and earlier versions, which stems from a directory traversal vulnerability that allows remote attackers to obtain sensiti...

CVE-2024-46985

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

SAP NetWeaver Administrator Server-Side Request Forgery Vulnerability

SAP NetWeaver Administrator SAP NWA is a Web-based framework tool for administration, configuration, and monitoring from SAP, Germany. A server-side request forgery vulnerability exists in SAP NetWeaver Administrator, which stems from the product's failure to properly validate user input, and can...

SAP NetWeaver Administrator 代码问题漏洞

SAP NetWeaver Administrator SAP NWA is a Web-based framework tool for administration, configuration, and monitoring from SAP, Germany. A server-side request forgery vulnerability exists in SAP NetWeaver Administrator, which stems from the product's failure to properly validate user input, and can...

QNAP Notes Station 3 Server-Side Request Forgery Vulnerability

QNAP Notes Station 3 is a private cloud notes software that runs on QNAP NAS devices and supports real-time multi-person collaboration, version control, data encryption and snapshot backup. A server-side request forgery vulnerability exists in QNAP Notes Station 3. The vulnerability stems from th...

CVE-2024-32965 ssrf vulnerability in lobe-chat

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header...

CVE-2024-32965 ssrf vulnerability in lobe-chat

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header...

@lobehub/chat Server Side Request Forgery vulnerability

Summary lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. Details visit https://chat-preview.lobehub.com/ click settings - llm - openai fill the...

GHSA-2XCC-VM3F-M8RW @lobehub/chat Server Side Request Forgery vulnerability

Summary lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. Details visit https://chat-preview.lobehub.com/ click settings - llm - openai fill the...

CVE-2024-32965: Server-Side Request Forgery (SSRF)

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header...

PT-2024-25012

Name of the Vulnerable Software and Affected Versions lobe-chat versions prior to 1.19.13 Description Lobe Chat is an open-source, AI chat framework. The issue allows an attacker to construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive...

Lobe Chat 代码问题漏洞

Lobe Chat is an open source, high-performance chatbot framework open-sourced by LobeHub. A code issue vulnerability exists in Lobe Chat versions prior to 1.19.13, which stems from vulnerability to server-side request forgery attacks that could allow an attacker to launch an attack without logging...