CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

PoC_CVE-2017-3164_CVE-2017-1262

Apache Solr Poc CVE-2017-3164 CVE-2017-12629 This folder contains example exploits for Apache Solr CVE-2017-3164 CVE-2017-12629 To be use ONLY for education purposes and with full permission of the Apache Solr Server owner. You will need to know the IP or DNS name of the Apache Solr server and th...

ShellTorchChecker

ShellTorch Checker Tool This tool checks if a TorchServe instance is vulnerable to CVE-2023-43654 and provides possible ways for mitigation. For more details please see our full report at https://www.oligo.security/blog/shelltorch-torchserve-ssrf-vulnerability-cve-2023-43654 To run the tool,...

CVE-2026-116069

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

CVE-2026-116066

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private...

CVE-2023-27163-ssrf-to-port-scanning

This repository does not have a README...

CVE-2026-41177-Squidex-CMS

CVE-2026-41177: Squidex CMS Blind SSRF Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery SSRF vulnerability in the Squidex CMS Restore API. Vulnerability Overview CVE ID: CVE-2026-41177 Affected Component: Squidex API: Backup / Restore Engine /api/apps/restor...

CVE-2024-48590

CVE-2024-48590 Vulnerability Disclosure: SSRF in Inflectra SpiraTeam 7.2.00 Description Inflectra SpiraTeam version 7.2.00 is vulnerable to Server-Side Request Forgery SSRF through the NewsReaderService component. Vulnerability Type Server-Side Request Forgery SSRF Vendor Inflectra Affected Produ...

CVE-2022-36804-PoC

CVE-2022-36804-PoC Multithreaded exploit script for CVE-2022-36804 affecting most BitBucket versions 8.3.1 See the full advisory here https://jira.atlassian.com/browse/BSERV-13438 All credit to TheGrandPew for discovery The script will automatically detect public repositories located on bitbucket...

CVE-2026-116069

NiubiGEO versions prior to 0.3.2 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the POST /audit-plan endpoint, where an attacker can provide a crafted domain value to force the server to fetch internal addresses. By submitting IP literals , localhost ...

CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

EUVD-2026-109383

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

CVE-2026-116066

The Firecrawl software version before 2.11.586 is vulnerable to a Server-Side Request Forgery (SSRF) in the Playwright service SSRF proxy. The root cause is a DNS rebinding flaw that allows attackers to bypass isInternalHost checks. By controlling the DNS for a scrape target, an attacker can prov...

CVE-2026-116066 Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private...

EUVD-2026-109380

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private...

PAYLOAD-LISTS

Payloads List of payloads: SSTI-injection payloads XXE payloads XSS payloads Server Side Request ForgerySSRF SQL injection payloads Open Redirect payloads NoSQL injection payloads LDAP injection payloads File inclusion payloads Command injection payloads CRLF injection payloads Code injection...

Solr-SSRF

Solr-SSRF Apache Solr SSRF Usage - Apache Solr SSRF vulnerability CVE-2021-27905 - Options: -h or --help : Description -u or --url : Site URL address -d or --dnslog : DnsLog Example python3 CVE-2021-27905.py -u URL -d dnslog...

forgejo-openid-discovery-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-openid-discovery-ssrf forgejo-openid-discovery-ssrf Class: SSRF Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo When openid ENABLEOPENIDSIGNIN is on, unauthenticated POST /user/login/openid hands the attacker U...

CVE-2026-33534

CVE-2026-33534 - EspoCRM 9.3.3 Authenticated SSRF Authenticated SSRF proof-of-concept for EspoCRM 9.3.3 via alternative IPv4 loopback notation in the /api/v1/Attachment/fromImageUrl endpoint. Summary EspoCRM 9.3.3 blocks direct loopback URLs such as http://127.0.0.1/..., but the server-side fetch...

CVE-2026-32096

CVE-2026-32096 SSRF via unvalidated AWS SNS SubscriptionConfirmation inuseplunk/plunk Summary The Plunk API endpoint POST /webhooks/sns fetches an attacker-supplied SubscribeURL without verifying the AWS SNS cryptographic signature. An unauthenticated attacker can force the server to make arbitra...