2058 matches found
CVE-2025-62612 FastGPT File Reading Node SSRF Vulnerability
FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1...
EUVD-2025-35204
Zimbra Collaboration ZCS before 10.1.12 allows SSRF because of the configuration of the chat proxy...
CVE-2025-34282 ThingsBoard < v4.2.1 SVG Image SSRF
ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...
CVE-2025-62505 SSRF in lobehub/lobe-chat with native web fetch module
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...
CVE-2025-59146 New API has Authenticated Server-Side Request Forgery (SSRF) issue
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. An authenticated Server-Side Request Forgery SSRF vulnerability exists in versions prior to 0.9.0.5. A feature within the application allows authenticated users to submit a URL for the server to...
CVE-2025-59146
Summary: CVE-2025-59146 targets the “New API” SSRF in versions before 0.9.0.5. An authenticated user can submit a URL for the server to fetch, with improper validation allowing server-side requests to arbitrary internal or external destinations. The issue is fixed in 0.9.0.5, which adds a default...
CVE-2025-61768
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF Server-Side Request Forgery vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external imag...
GHSA-527M-2XHR-J27G LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...
CVE-2025-61784
LLaMA-Factory's chat API contains SSRF and LFI in the _process_request function (src/llamafactory/api/chat.py). For image_url, video_url, and audio_url, if a URL is not a base64 data URI or local file path, the code fetches the URL with requests.get(url, stream=True).raw without validation, enabl...
EUVD-2018-20547
Malware in sbrugna...
EUVD-2020-3806
Malware in sbrugna...
EUVD-2021-19479
Malware in sbrugna...
EUVD-2021-1130
Malware in sbrugna...
EUVD-2020-18662
Malware in sbrugna...
EUVD-2020-7858
Malware in sbrugna...
EUVD-2017-18005
Malware in sbrugna...
EUVD-2019-0419
Malware in sbrugna...
EUVD-2018-8594
Malware in sbrugna...