CVE-2020-36944

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...

EUVD-2020-30890

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...

CVE-2020-36944 ILIAS Learning Management System 4.3 - SSRF

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...

CVE-2020-36944 ILIAS Learning Management System 4.3 - SSRF

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...

GHSA-QH4C-XF7M-GXFC vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

Summary A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods obtain and process media from URLs provided by users, using different Python parsing libraries when restrictin...

Server-side Request Forgery (SSRF)

Overview agentos-taskweaver is an A code-first agent framework for seamlessly planning and executing data analytics tasks Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the network configuration process. An attacker can access local services running on th...

Server-Side Request Forgery (SSRF)

shopware/core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied input used in server-side HTTP requests, which allows an attacker to coerce the server into sending requests to internal or external systems, potentially leading to...

WordPress AI Engine plugin <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery vulnerability

Authenticated Subscriber+ Server-Side Request Forgery vulnerability discovered by type5afe in WordPress Plugin AI Engine versions = 3.3.2...

CVE-2025-14610

CVE-2025-14610 : The WordPress plugin TableMaster for Elementor (versions up to and including 1.3.6) is vulnerable to authenticated SSRF via the csv_url parameter in the Data Table widget. An attacker with Author-level access or higher can trigger web requests to arbitrary locations (including lo...

CVE-2025-14610

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricting which URLs can be fetched when importing CSV data from a URL in the Data Table widget. This makes it possible for...

CVE-2025-14610 TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricting which URLs can be fetched when importing CSV data from a URL in the Data Table widget. This makes it possible for...

EUVD-2025-206417

The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricting which URLs can be fetched when importing CSV data from a URL in the Data Table widget. This makes it possible for...

WordPress TableMaster for Elementor plugin <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter vulnerability

Authenticated Author+ Server-Side Request Forgery via 'csvurl' Parameter vulnerability discovered by WordFence in WordPress Plugin TableMaster for Elementor versions = 1.3.6...

NocoDB code-related vulnerabilities

NocoDB is an open-source alternative to Airtable. It converts any MySQL, PostgreSQL, SQL Server, SQLite, and MariaDB databases into intelligent spreadsheets. Versions of NocoDB prior to 0.301.0 have code vulnerabilities; these vulnerabilities stem from a blind server-side request forgeing...

ILIAS code-related vulnerabilities

ILIAS is an open-source learning management system developed by ILIAS. Version 4.3 of ILIAS has code-related vulnerabilities; these vulnerabilities stem from server-side request forgery in the portfolio PDF export function, which may lead to the reading of local files...

PT-2026-5185

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0 Description Discourse is an open source discussion platform. A hostname validation issue in the...

PT-2026-5151

Name of the Vulnerable Software and Affected Versions ILIAS Learning Management System version 4.3 Description The ILIAS Learning Management System contains a server-side request forgery issue. This allows attackers to read local files through the portfolio PDF export functionality. Attackers can...

WordPress plugin TableMaster for Elementor: Code issues and vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the MediaConnector class. An attacker can access internal network resources and cause system instability or...

CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.14.1, a Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods obtain and process...