CVE-2025-27777 Applio allows SSRF and file write in model_download.py

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery SSRF in modeldownload.py line 195 in 3.2.7. The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself ...

CVE-2025-27777

CVE-2025-27777 affects Applio (voice conversion tool). Versions ≤ 3.2.7 contain a server‑side request forgery (SSRF) in model_download.py (line 195 in 3.2.7) that can be used to issue requests on behalf of the Applio server. The issue is described as a blind SSRF, with potential to probe internal...

CVE-2025-27777 Applio allows SSRF and file write in model_download.py

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery SSRF in modeldownload.py line 195 in 3.2.7. The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself ...

CVE-2025-27784 Applio allows arbitrary file read in train.py export_pth function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportpth function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27784

Applio CVE-2025-27784 affects Applio voice conversion tool (versions 3.2.8-bugfix and prior). The issue is an arbitrary file read in train.py's export_pth function, allowing reading arbitrary server files. It can be chained with blind server-side request forgery (SSRF) to access files on internal...

CVE-2025-27784 Applio allows arbitrary file read in train.py export_pth function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportpth function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27784 Applio allows arbitrary file read in train.py export_pth function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportpth function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27785 Applio allows arbitrary file read in train.py export_index function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportindex function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27785

CVE-2025-27785 (Applio) affects Applio up to version 3.2.8-bugfix, where the train.py function export_index allows arbitrary file reads. The underlying issue enables reading files on the Applio server and can be leveraged with blind server-side request forgery to access files on internal systems ...

CVE-2025-27785 Applio allows arbitrary file read in train.py export_index function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportindex function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-22474

Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains a Server-Side Request Forgery SSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

PT-2025-11978 · Applio · Applio

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.7 and prior Description: Applio is a voice conversion tool that is vulnerable to server-side request forgery SSRF and file write in model download.py. The blind SSRF allows for sending requests on behalf of the Applio serv...

PT-2025-11979 · Applio · Applio

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.7 and prior Description: Applio is a voice conversion tool. The issue allows for server-side request forgery SSRF in model download.py, which can be leveraged to probe for other vulnerabilities on the server itself or on...

PT-2025-12331

Apache Druid and Affected Versions Apache Druid versions prior to 31.0.2 and prior to 32.0.1 Description Apache Druid is susceptible to Server-Side Request Forgery SSRF, Cross-Site Scripting XSS, and Open Redirect issues. When the Druid management proxy is used, a specially crafted URL in a reque...

Dell SmartFabric OS10 Server-Side Request Forgery Vulnerability

Dell SmartFabric OS10 is a Linux-based network switch operating system from Dell Dell. Dell SmartFabric OS10 suffers from a server-side request forgery vulnerability, which stems from the server not implementing an adequate authentication mechanism to confirm the origin of the request, and can be...

PT-2025-11976 · Applio · Applio

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.7 and prior Description: Applio is a voice conversion tool. It is susceptible to server-side request forgery SSRF and file write vulnerabilities in model download.py line 156 in version 3.2.7. The blind SSRF allows sending...

PT-2025-11984 · Applio · Applio

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.8-bugfix and prior Description: The issue affects a voice conversion tool and may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read file...

CVE-2024-49822

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2024-49822 IBM QRadar Advisor server-side request forgery

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2024-49822

CVE-2024-49822 affects IBM QRadar Advisor (versions 1.0.0–2.6.5). A server-side request forgery (SSRF) flaw allows an authenticated attacker to send unauthorized requests from the QRadar system, potentially enabling network enumeration or facilitating further attacks. Root cause: SSRF in the Advi...