11701 matches found
CVE-2025-2940 Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the argsurl parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from th...
CVE-2025-2940
CVE-2025-2940 (Ninja Tables – Easy Data Table Builder for WordPress) is a confirmed SSRF vulnerability present in all versions up to 5.0.18, exploitable via the args[url] parameter. An unauthenticated attacker can make web requests from the vulnerable WordPress instance to arbitrary locations, en...
CVE-2025-2940 Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the argsurl parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from th...
CVE-2024-51980
An unauthenticated attacker may perform a limited server side request forgery SSRF, forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service HTTP TCP port 80 SOAP request. The...
CVE-2024-51981
An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...
Server Side Request Forgery (SSRF)
langchaincommunity is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to lack of request filtering or validation, which allows the component to send requests to internal or local network addresses...
CVE-2025-2940: Server-Side Request Forgery (SSRF)
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the argsurl parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from th...
PT-2025-27148 · Lychee · Lychee
Name of the Vulnerable Software and Affected Versions: Lychee versions prior to 6.6.13 Description: A critical Server-Side Request Forgery SSRF issue exists in the "/api/v2/Photo::fromUrl" endpoint, allowing an attacker to instruct the application's backend to make HTTP requests to any URL they...
PT-2025-27142
Name of the Vulnerable Software and Affected Versions: diyhi bbs versions up to 6.8 Description: A critical issue has been discovered that affects the getUrl function of the /admin/login file in the HTTP Header Handler component. The manipulation of the Host argument leads to server-side request...
PT-2025-27071 · WordPress · The Ninja Tables
Name of the Vulnerable Software and Affected Versions: The Ninja Tables – Easy Data Table Builder plugin for WordPress versions up to, and including, 5.0.18 Description: The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. Th...
WordPress Ninja Tables – Easy Data Table Builder plugin <= 5.0.18 - Unauthenticated Server-Side Request Forgery vulnerability
Unauthenticated Server-Side Request Forgery vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ninja Tables versions = 5.0.18...
CVE-2025-52888
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser DocumentBuilderFactory and...
CVE-2025-49852
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers...
PT-2025-30926
Name of the Vulnerable Software and Affected Versions Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description The issue is a Server-Side Request Forgery SSRF in the Flow Data Source modules of Tableau Server on...
PT-2025-30928
Name of the Vulnerable Software and Affected Versions Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description Tableau Server is susceptible to a Server-Side Request Forgery SSRF issue within the EPS Server modules...
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of t...
GHSA-H7QF-QMF3-85QG Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...
