Lucene search
+L

57275 matches found

CVE
CVE
added 2026/08/23 3:45 a.m.13 views

CVE-2026-78061

CVE-2026-78061 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability is a server-side request forgery (SSRF) in the Email Sync component, specifically in the function buildImapConfig within lib/email-sync/imap-client.ts. An attacker can manipulate the host/port arguments to force the se...

6.5CVSS6.3AI score
SaveExploits0References7
EUVD
EUVD
added 2026/08/23 3:45 a.m.10 views

EUVD-2026-64626

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

6.5CVSS6.3AI score
SaveExploits0References7
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

9.1CVSS8.4AI score0.20249EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.132 views

Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

8.2CVSS8.1AI score0.11154EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.122 views

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

5.3CVSS6.8AI score0.00875EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.140 views

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

5.3CVSS5.5AI score0.02214EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.31 views

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

7.3CVSS5.4AI score0.01933EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.92 views

Rocket.Chat - Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. id: CVE-2024-39713 info: name: Rocket.Chat - Server-Side Request Forgery SSRF author: iamnoooob,rootxharsh,pdresearch severity: high description: | A Server-Side Request Forgery SSRF affects...

8.6CVSS8AI score0.03201EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.53 views

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

7.2CVSS7.9AI score0.05213EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.74 views

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

8.5CVSS7.9AI score0.7829EPSS
SaveExploits13References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.175 views

WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

7.2CVSS6.8AI score0.41762EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.33 views

Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)

Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter. id: CVE-2020-16248 info: name: Prometheus Blackbox Exporter - Server-Side...

5.8CVSS5.8AI score0.02698EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.71 views

DedeCMS 5.7.109 - Server-Side Request Forgery

Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...

9.8CVSS6.2AI score0.0357EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.96 views

Hurrakify <= 2.4 - Server-Side Request Forgery

The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify...

7.2CVSS7.8AI score0.01461EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.102 views

Owncast - Server Side Request Forgery

Server-Side Request Forgery SSRF in GitHub repository owncast/owncast prior to 0.1.0. id: CVE-2023-3188 info: name: Owncast - Server Side Request Forgery author: DhiyaneshDk severity: medium description: | Server-Side Request Forgery SSRF in GitHub repository owncast/owncast prior to 0.1.0. impac...

8.3CVSS7.3AI score0.01356EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.41 views

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

The WPB Show Core WordPress plugin through version 2.2 is vulnerable to Server-Side Request Forgery SSRF via the 'path' parameter in the download-file.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2023-5974 info: nam...

9.8CVSS8.9AI score0.0315EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)

OneNav v0.9.35-20240318 is vulnerable to server-side request forgery SSRF via the url parameter in the getlinkinfo API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-33832 info: name: OneNav v0.9.35-20240318 - Server-Side Reque...

6.3CVSS5.6AI score0.0072EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.22 views

LyLme spage v1.9.5 - Server-Side Request Forgery

LyLme spage v1.9.5 is vulnerable to server-side request forgery SSRF via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-36675 info: name: LyLme spage v1.9.5 - Server-Side Request Forgery...

9.1CVSS5.6AI score0.01438EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.54 views

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

8.2CVSS7.3AI score0.02001EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.30 views

WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery

The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery SSRF via the 'url' parameter in the getremotedata.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2024-4399 info: name: WordPre...

9.1CVSS5.6AI score0.01821EPSS
SaveExploits2References2
Rows per page
Query Builder