CVE-2025-8527 Exrick xboot Swagger SecurityController.java server-side request forgery

A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagger. The manipulation of the argument...

CVE-2025-8527

CVE-2025-8527 affects Exrick xboot up to version 3.3.4, involving the Swagger component. The root cause is server-side request forgery triggered by manipulation of the loginUrl parameter in SecurityController.java (xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/). This Vu...

CVE-2025-8520

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520

CVE-2025-8520 affects givanz Vvveb up to version 1.0.5, specifically the Drag-and-Drop Editor’s /vadmin123/?module=editor/editor endpoint. The issue is a server-side request forgery triggered by manipulating the url argument, enabling remote initiation. Public exploitation has been disclosed. A f...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

SUSE-SU-2025:02685-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2024-42516: Fixed HTTP response splitting. bsc1246477 - CVE-2024-43204: Fixed a SSRF when modproxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. bsc1246305 - CVE-2024-47252: Fixed insufficie...

SUSE-SU-2025:02684-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2024-42516: Fixed HTTP response splitting. bsc1246477 - CVE-2024-43204: Fixed a SSRF when modproxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. bsc1246305 - CVE-2024-47252: Fixed insufficie...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL validation process. An attacker can access internal or otherwise restricted resources by submitting a specially crafted URL that bypasses configured allowlists. Remediation Upgrade...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-27817)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2025-1113)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1113 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

PT-2025-31876 · Unknown · Cloudfavorites Favorites-Web

Name of the Vulnerable Software and Affected Versions: cloudfavorites favorites-web versions up to 1.3.0 Description: A critical vulnerability exists in cloudfavorites favorites-web. The getCollectLogoUrl function within the app/src/main/java/com/favorites/web/CollectController.java file is...

Amazon Linux 2 : php (ALASPHP8.1-2025-007)

The version of php installed on the remote host is prior to 8.1.33-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2025-007 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2025-1087)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1087 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

PT-2025-31870 · Exrick +1 · Exrick Xboot +1

Name of the Vulnerable Software and Affected Versions: Exrick xboot versions through 3.3.4 Description: A critical vulnerability exists in Exrick xboot related to the Swagger component. The issue involves server-side request forgery SSRF resulting from the manipulation of the loginUrl argument...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2025-1114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1114 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

favorites-web 代码问题漏洞

favorites-web cloudfavorites is a cloudfavorites open source website built with Spring Boot. A code issue vulnerability exists in favorites-web version 1.3.0 and earlier, which stems from an incorrect manipulation of the parameter url resulting in a server-side request forgery...

PT-2025-31849 · Unknown · Givanz Vvveb

Name of the Vulnerable Software and Affected Versions: givanz Vvveb versions up to 1.0.5 Description: A critical vulnerability exists in the Drag-and-Drop Editor component of givanz Vvveb. The vulnerability is due to server-side request forgery, which can be triggered by manipulating the url...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2025-1088)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1088 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...