Next.js Middleware - Server-Side Request Forgery

In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next, an attacker could exploit this behavior to perform Server-Side Request Forgery SSRF attacks. id: CVE-2025-57822 info: name: Next.js Middleware - Server-Side Request Forgery author:...

Elestio Memos <= v0.24.0 - Server-Side Request Forgery

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. id: CVE-2025-22952 info: name: Elestio Memos = v0.24.0 - Server-Side Request Forgery author: iamnoooob,rootxharsh,pdresearc...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

Ligeo Archives Ligeo Basics - Server Side Request Forgery

Ligeo Archives Ligeo Basics as of 0201-2022 is vulnerable to Server Side Request Forgery SSRF which allows an attacker to read any documents via the download features. id: CVE-2021-46107 info: name: Ligeo Archives Ligeo Basics - Server Side Request Forgery author: ritikchaddha severity: high...

Qualitor <= v8.24 - Server-Side Request Forgery

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php. id: CVE-2024-48360 info: name: Qualitor = v8.24 - Server-Side Request Forgery author: s4e-io severity: high description: | Qualitor v8.24 was discovered to contain a Server-Si...

CVE-2025-45250

CVE-2025-45250 Descrizione suggerita root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Benvenuti nel repository ufficiale che documenta la scoperta e i dettagli della CVE-2025-26206 , una critica vulnerabilità di Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0. Scoperta da B. Sibhi , quest...

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork: app:"Microsoft Exchange Server" Script escrito com o kit de ferramentas Seebug e o pocsuite3 MicrosoftExchangeServerSSRFCVE-2021-26855.py, para sondar dados do último ano: Taxa de sucesso de aproximadamente: 1500 / 5000 = 30%...

EUVD-2026-67400

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag versions 2 through 2.6.14 are affected by a Server-Side Request Forgery (SSRF) vulnerability caused by a crafted title or content field being mishandled during PDF export . The CVSS 3.1 score is 6.4 (Medium) with a scope change, indicating that exploitation could affect a different secur...

cve-2026-40072-ssrf-lab

Lab SSRF CVE-2026-40072 Laboratorio locale pratico per dimostrare la CVE-2026-40072 in web3.py, mostrare l'impatto SSRF in Burp Suite e verificare la correzione ufficiale. Panoramica Questa repository contiene una proof of concept sicura e solo locale per la CVE-2026-40072, un problema di...

CVE-2026-78498

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 Reference report: GHSA-pgpj-v85q-h5fm Questo repository contiene una configurazione docker compose che configura sia un server pyLoad sia un server attaccante che fornisce semplicemente un csrf.html. Per testare tu stesso, esegui docker composer up devi avere docker composer...

poc_proxylogon

pocproxylogon PoC do Microsoft Exchange ProxyLogon CVE-2021-26855 Este script foi originalmente criado por celesian para explorar esta CVE. Depois, eu o atualizei para explorar um servidor Exchange vulnerável a SSRF, mas ele obtém uma shell explorando o recurso EWS, porque uma empresa cliente...

Havoc-C2-SSRF-poc

CVE-2024-41570: Havoc-C2-SSRF-poc Questa vulnerabilità viene sfruttata falsificando la registrazione e i check-in di un agente demon per aprire un socket TCP sul teamserver e leggere/scrivere dati da esso. Ciò consente agli attaccanti di far trapelare gli IP di origine dei teamserver e molto altr...

EUVD-2026-67301

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function sfetchpage/sfetchpattern of the file src/scraplingfetchmcp/fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgradi...

CVE-2025-45955

CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Descrizione Un attaccante può sfruttare questa vulnerabilità caricando ed eseguendo un file PHP appositamente predisposto sulla piattaforma di hosting Ferozo. Una volta accessibile, il file lancia una serie di tentativi SS...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499 Dimension SSRF via FTP Server Test Connection

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 एक्सप्लॉइट शीर्षक: वाहन सेवा प्रबंधन प्रणाली - 'मल्टीपल' क्रॉस-साइट रिक्वेस्ट फॉर्जरी CSRF संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS की ओर ले जाता है एक्सप्लॉइट लेखक: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 मध्यम संदर्भ:...