CVE-2025-50125

A CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header...

CVE-2025-6851

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851

The CVE-2025-6851 entry concerns the WordPress Broken Link Notifier plugin. Affected are versions up to and including 1.3.0, where the ajax_blinks() path ultimately calls check_url_status_code(), allowing unauthenticated SSRF from the web application to reach arbitrary external or internal locati...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

PT-2025-29219 · WordPress · Broken Link Notifier

Name of the Vulnerable Software and Affected Versions: Broken Link Notifier plugin for WordPress versions prior to 1.3.1 Description: The plugin is susceptible to Server-Side Request Forgery SSRF. This allows unauthenticated attackers to make web requests to arbitrary locations originating from t...

CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

PT-2025-29230

Name of the Vulnerable Software and Affected Versions JGM Pandoc version 3.6.4 Description A Server-Side Request Forgery SSRF issue exists in JGM Pandoc version 3.6.4. This flaw allows attackers to potentially compromise the entire infrastructure by injecting a crafted iframe. Reports indicate...

CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

Apache 2.4.x < 2.4.64 Multiple Vulnerabilities

The version of Apache httpd installed on the remote host is prior to 2.4.64. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.64 advisory. - In some modssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is...

CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

WordPress Amazon Products to WooCommerce plugin code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A code issue vulnerability exists in the WordPress Amazon Products to WooCommerce plugin that stems from insufficient validation of the function wcta2wgeturls, which can be...

PT-2025-29269 · Postiz · Postiz

Name of the Vulnerable Software and Affected Versions: Postiz versions 1.45.1 through 1.62.3 Description: The Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This enables a server-side request forgery SSRF condition, allowing...

CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

CVE-2025-51591

The CVE-2025-51591 SSRF flaw affects Pandoc, reportedly in v3.6.4, allowing an attacker to access the internal infrastructure via a crafted iframe injection. Public sources describe that Pandoc can retrieve and parse untrusted HTML content, enabling SSRF, with mitigations including using the --sa...

PT-2025-29226 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and...

WordPress Broken Link Notifier plugin <= 1.3.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Broken Link Notifier versions = 1.3.0...

CVE-2024-43394

A Server-Side Request Forgery SSRF flaw was found in Apache HTTP Server on Windows. This issue can allow NTLM hashes to be leaked to a malicious server via modrewrite or apache expressions that pass unvalidated request input. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-53371

CVE-2025-53371 concerns the DiscordNotifications extension for MediaWiki. The vulnerability arises from the extension’s ability to send requests (via curl and file_get_contents) to arbitrary URLs configured through $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This can...