WordPress PayMaster for WooCommerce plugin <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery vulnerability

Authenticated Subscriber+ Server-Side Request Forgery vulnerability discovered by Poli in WordPress Plugin PayMaster for WooCommerce versions = 0.4.31...

CVE-2025-34051

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Allmart versions = 1.0.0...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-5817

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-5817 Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-5817

The CVE-2025-5817 entry concerns the WordPress plugin Amazon Products to WooCommerce. It is a Server-Side Request Forgery (SSRF) via wcta2w_get_urls() affecting all versions up to 1.2.7. It allows unauthenticated attackers to forward web requests from the application to arbitrary locations, poten...

CVE-2025-5817 Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

HPESBNW04886 rev.1 - HPE Telco Service Orchestrator Software, Server-Side Request Forgery (SSRF) Vulnerability

Potential Security Impact: Remote: Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-27817 |...

WordPress Amazon Products to WooCommerce plugin <= 1.2.7 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ch4r0n in WordPress Plugin Amazon Products to WooCommerce versions = 1.2.7...

CVE-2025-34051

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051

Multiple firmware versions of AVTECH DVR devices are vulnerable to a Server-Side Request Forgery (SSRF) . The vulnerability stems from an unauthenticated /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint. An attacker can manipulate the ip , port , and queryb64str parameters to force the DVR to...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

PT-2025-27535 · Avtech · Avtech Dvr

Name of the Vulnerable Software and Affected Versions: AVTECH DVR devices affected versions not specified Description: A server-side request forgery issue exists in AVTECH DVR devices, exposing the "/cgi-bin/nobody/Search.cgi?action=cgi query" endpoint without authentication. An attacker can...

CVE-2025-45872

The ZrLog blogging system (version 3.1.5 ) is vulnerable to a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. This flaw allows an attacker to perform unauthorized requests, potentially providing access to internal resources. As a temporary workaround, it is recommended to restri...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

BIT-ELK-2025-25012 Kibana Open Redirect

URL redirection to an untrusted site 'Open Redirect' in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL...