CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...

Adobe Commerce/Magento Open Source Multiple Vulnerabilities (APSB24-40)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...

PT-2025-30523 · Unknown · Private-Ip

Name of the Vulnerable Software and Affected Versions: private-ip affected versions not specified Description: The package is susceptible to a Server-Side Request Forgery SSRF issue. An attacker can exploit this by providing an IP address or hostname that resolves to a multicast IP address...

The vulnerability of the FastReport.NET report and document generation library lies in the improper limitation of XML references to external objects. This allows attackers to gain unauthorized access to files and perform SSRF attacks.

The vulnerability of the FastReport.NET report and document generation library is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to files and perform a SSRF attack...

PT-2025-30533 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: The software contains an Improper Restriction of XML External Entity Reference vulnerability that allows Server Side Request Forgery. Recommendations: Update MagicINFO 9 Server to...

PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image...

CVE-2025-46385

CWE-918 Server-Side Request Forgery SSRF...

CVE-2025-34142

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

Exploit for Server-Side Request Forgery in Fusion_Builder_Project Fusion_Builder

CVE-2022-1386 – Fusion Builder Example: bash python3...

Server Side Request Forgery (SSRF)

org.glassfish.main.admingui, console-common is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of user-supplied URLs in specific endpoints, which allows an attacker to make arbitrary requests to internal or external systems on behalf of the server...

CVE-2025-54122 Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

CVE-2025-54122

The CVE-2025-54122 entry concerns Manager-io/Manager accounting software with an unauthenticated SSRF in the proxy handler used by both Desktop and Server editions. Affected versions go up to 25.7.18.2519; the vulnerability allows bypassing network isolation and reaching internal services or clou...

CVE-2025-52362

Server-Side Request Forgery SSRF vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL...

CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...

CVE-2025-52362

Server-Side Request Forgery SSRF vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL...

PT-2025-30336 · Phproxy · Phproxy

Name of the Vulnerable Software and Affected Versions: PHProxy versions prior to 1.1.1 Description: A Server-Side Request Forgery SSRF issue exists in the URL processing functionality. Insufficient input validation for the proxurl parameter allows a remote, unauthenticated attacker to submit a...

CVE-2025-36845

CVE-2025-36845 affects Eveo URVE Web Manager 27.02.2025. A server-side request forgery exists in /_internal/redirect.php due to improper validation of the URL input, enabling the app server to request internal endpoints and reflect content in the response. The Nuclei template confirms the SSRF pa...

CVE-2025-52362

PHProxy is affected by a Server-Side Request Forgery (SSRF) vulnerability in the URL processing functionality up to version 1.1.1. The issue arises from insufficient input validation of the _proxurl parameter, enabling a remote, unauthenticated attacker to submit a crafted URL. Severity is indica...

CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...