CVE-2026-22874-PoC

CVE-2026-22874 — Gitea SSRF PoC ⚠️ HAFTUNGSAUSSCHLUSS : Dieses PoC ist NUR für autorisiertes Testing auf Gitea-Instanzen = 1.26.3 Rechtmäßige Anwendungsfälle Sicherheitsforschung mit ausdrücklicher Genehmigung Testing im Labor/Entwicklung Validierung von Schutzmaßnahmen Maßnahmen, falls Sie nicht...

CVE-2026-9491

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2024-21893.py

CVE-2024-21893 ist eine Server-Side-Request-Forgery-Schwachstelle in der SAML-Komponente von Ivanti Connect Secure 9.x, 22.x und Ivanti Policy Secure 9.x, 22.x und Ivanti Neurons for ZTA, die es einem Angreifer ermöglicht, ohne Authentifizierung auf bestimmte eingeschränkte Ressourcen zuzugreifen...

Xstream-1.4.17

Xstream-1.4.17 ऊपर दिया गया Xstream डेमो वातावरण मेरे द्वारा स्थापित किया गया है, शोषण वातावरण JDK1.8u131 पर आधारित है, वर्तमान में स्थानीय परीक्षण और HTTP रिमोट पैकेट भेजने का समर्थन करता है XSTREAM=1.4.17 भेद्यता पुनरुत्पादन CVE-2021-39141, CVE-2021-39144, CVE-2021-39150, CVE-2021-39152 यह प्रय...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Server-Side Request Forgery não autenticado Descrição O plugin Radio Player – Live Shoutcast, Icecast e qualquer player de streaming de áudio para WordPress é vulnerável a Server-Side Request Forgery em todas as versões até, e incluindo, a 2.0.82. Isso permi...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ Ausschließliche Verwendung zu Bildungszwecken und in autorisierten Umgebungen. Funktionsfähiger PoC für die Schwachstelle CVE-2022-47447, die ein anfälliges WordPress-Plugin betrifft und einen Cross-Site Request Forgery CSRF-Angriff gegen authentifiziert...

CVE-2023-27163

Preuve de concept PoC de SSRF sur Request-Baskets CVE-2023-27163 Ce dépôt contient une preuve de concept PoC pour CVE-2023-27163, une vulnérabilité de Server-Side Request Forgery SSRF découverte dans request-baskets jusqu'à la version 1.2.1. Cette vulnérabilité permet aux attaquants d'accéder à d...

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)

Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter. id: CVE-2020-16248 info: name: Prometheus Blackbox Exporter - Server-Side...

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...

Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Rocket.Chat - Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. id: CVE-2024-39713 info: name: Rocket.Chat - Server-Side Request Forgery SSRF author: iamnoooob,rootxharsh,pdresearch severity: high description: | A Server-Side Request Forgery SSRF affects...