Linux Distros Unpatched Vulnerability : CVE-2016-6621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery...

CVE-2025-9395

A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileName leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be use...

Linux Distros Unpatched Vulnerability : CVE-2019-9187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via fil...

CVE-2025-7813

CVE-2025-7813 refers to the Eventin plugin for WordPress (The Events Calendar, Event Booking, Registrations and Event Tickets) where SSRF exists in all versions up to 4.0.37 via the proxy_image function. The vulnerability allows unauthenticated attackers to make web requests from the application ...

CVE-2025-27217

A Server-Side Request Forgery SSRF in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope...

Linux Distros Unpatched Vulnerability : CVE-2024-6763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpU...

Linux Distros Unpatched Vulnerability : CVE-2024-22243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the...

Apache EventMesh security vulnerabilities

Apache EventMesh is a new generation of serverless event middleware from the Apache Foundation for building distributed event-driven applications. A security vulnerability exists in Apache EventMesh, which stems from a server-side request forgery vulnerability in WebhookUtil.java that could resul...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +23 more potentially affected by CVE-2025-55303 via astro (>=5.0.0-beta.5, <=5.12.8)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.0.1, =1.25.426-4, =0.6.2, =0.0.0-dev-20250414184926, =0.0.1, =0.0.1, =0.0.1, =2.1.22, =1.0.3, =0.1.0, =0.4.2 and more Source cves: CVE-2025-55303 Source advisory: OSV:GHSA-XF8X-J4P2-F749...

PT-2025-33447 · WordPress · Quttera Web Malware Scanner

Name of the Vulnerable Software and Affected Versions: Quttera Web Malware Scanner for WordPress versions up to and including 3.5.1.41 Description: The Quttera Web Malware Scanner plugin for WordPress is susceptible to Server-Side Request Forgery via the RunExternalScan function. Authenticated...

CVE-2025-8680: Server-Side Request Forgery (SSRF)

The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fsapirequest function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to...

CVE-2025-53241

CVE-2025-53241 is a Server-Side Request Forgery (SSRF) affecting the WordPress Simplified plugin, with vulnerable versions listed as n/a through 1.0.9 (and related notes indicating up to 1.0.11 in advisories). The underlying issue is an SSRF vulnerability in Simplified that permits the server to ...

SUSE-SU-2025:01326-1 Security update for pgadmin4

This update for pgadmin4 fixes the following issues: - CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set bsc1239308 - CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary There are multiple vulnerabilities in Apache HTTP Server which affect the IBM HTTP Server used by IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2024-43204 DESCRIPTION: SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to...

VulnCheck KEV: CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...

(0Day) Schneider Electric EcoStruxure Power Monitoring Expert ExportDataAsXML Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the ExportDataAsXML...

Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities (CVE-2023-26125, CVE-2023-28155, CVE-2024-29018)

Summary Open source software is used by Astronomer with IBM as part of overall processing functionality. Vulnerability Details CVEID:CVE-2023-26125 DESCRIPTION: Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use...

Stirling-PDF code issue vulnerabilities

Stirling-PDF is a powerful, locally hosted, web-based PDF manipulation tool using Docker, open-sourced by Stirling Tools. A code issue vulnerability exists in Stirling-PDF versions prior to 1.1.0 that stems from a cleaner in the Markdown to PDF feature that can be bypassed, potentially leading to...

CVE-2025-4581

CVE-2025-4581 affects Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP 2025.Q1.0–2025.Q1.4 (as well as older 7.4 GA through update 92, and listed 2024 Qx releases). The root cause is improper validation of user-supplied URLs in the portal-settings-authentication-opensso-web component, enabling a pr...

CVE-2025-8355

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery SSRF...