EUVD-2026-82980

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

EUVD-2026-82892

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93506

SveltyCMS 0.0.6 is affected by a server-side request forgery (SSRF) vulnerability in the File Upload Endpoint at /mediagallery/upload-media. The root cause is described as "unknown processing" within that component. A remote, authenticated attacker (low privileges required) can exploit this with ...

CVE-2023-22047

Description: CVE-2023-22047 is unauthentication read file on oracle-peoplesoft. However, advance exploit attacker can use this vulnerability to execute remote code execution. In the peoplesoft application "Portal.war"," Serlet "WSRP Consumer ResourceProxy" enables the ability to read files and ma...

ssrf-king

🔥 ssrf-king 🔥 v1.12 Latest SSRF plugin for burp that Automates SSRF Detection in all of the Request If you are facing any problems or would like a new feature that is not listed below Please create a new issue below in this form Create New Issue Upcoming Features Checklist ✔️ It will soon have a...

ssrf-king

🔥 ssrf-king 🔥 v1.12 Última Plugin SSRF para Burp que automatiza la detección de SSRF en todas las solicitudes Si enfrentas algún problema o deseas una nueva función que no esté listada abajo Por favor, crea un nuevo issue a continuación en este formulario Create New Issue Lista de próximas...

CVE-2021-22054

CVE-2021-22054 Generate SSRF payloads References https://blog.assetnote.io/2022/04/27/advisory-vmware-workspace-one-uem/ https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/ Examples root@kitploit: generate POC python3 ssrf.py --url https://target.com --url https://example.com...

CVE-2023-27163

CVE-2023-27163 PoC CVE-2023-27163, SSRF, request-baskets up to v1.2.1 Usage example myscript.sh -i 10.10.11.111 -f 'localhost:80' -t 10.10.14.27 -i victim server IP -f IP or address to direct connections produced by the SSRF -t in this option goes your local IP or attacker IP, for generating the...

My-CVEs

A list of vulnerabilities I found. Some vulnerabilities come with deep technical writeups, exploits or even fuzzing session walkthroughs. Some vulnerabilities don't have CVEs because maintainers ghosted me, or because a maintainer didn't agree it's a security bug, I decided to release those as...

CVE-2026-75885

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2022-31188

CVE-2022-31188 CVE-2022-31188 - OpenCV CVAT Computer Vision Annotation Tool SSRF CVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with "Task Create" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other...

CVE-2026-62282

OpenCVE , a vulnerability intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in its notification testing feature for Webhook and Slack integrations . Prior to 3.0.0 , user-supplied HTTP/HTTPS destinations are not sufficiently validated, allowing an authenticated user with ...

SSRFmap

SSRFmap SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to...

CVE-2024-41651

Blind SSRF to RCE Exploit - PrestaShop 8.1.7 This document outlines a Blind SSRF to RCE exploit on a fresh PrestaShop 8.1.7 docker installation. Prerequisites Ensure you have at least an outdated module installed, for example: psfacetedsearch Download the original package: Download psfacetedsearc...

CVE-2026-93597

ArcadeDB versions before 26.9.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the SSRF guard used by the IMPORT DATABASE and server commands. The root cause is a failure to validate IPv6 transition addresses (NAT64, 6to4, or Teredo), allowing an authenticated attacker to supply UR...

Burp-Encode-IP

Acerca de Esta extensión codificará una dirección IP en un conjunto de técnicas de codificación menos conocidas. Esta técnica está enfocada en probar vulnerabilidades como SSRF Server-Side Request Forgery, Open Redirect o RFI Remote File Inclusion. Resumen Instalación sencilla Si tienes Burp Pro,...

CVE-2023-27163

CVE-2023-27163 Request-Baskets v1.2.1 - Server-side request forgery SSRF request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/baskets/name. This vulnerability allows attackers to access network resources and sensitive information via a...

ninjasworkout

Aplicación NodeJS Vulnerable a Propósito Inicio Rápido root@kitploit: Download the Repo = run npm i Después de instalar todas las dependencias, simplemente ejecute la aplicación root@kitploit: node app.js or nodemon app.js VULNERABILIDADES AGREGADAS Contaminación de Prototipos ✅1 Inyección NoSQL ...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and...