Portworx Half-Blind SSRF in kube-controller-manager

...

CVE-2025-13231

The WordPress Fancy Product Designer plugin (WooCommerce) is affected up to version 6.4.8 by a TOCTOU race condition in the fpd_custom_uplod_file AJAX action. The url parameter is validated with getimagesize(), then later fetched with file_get_contents(), enabling unauthenticated SSRF by serving ...

EUVD-2025-203530

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-13231 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-13231 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-67989 WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through = 4.1.3...

CVE-2025-67989

CVE-2025-67989 – Kerge SSRF (WordPress theme) Affected software: Kerge (Personal Portfolio Resume Theme)

CVE-2025-66407

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is...

Red Hat OpenShift code issues and vulnerabilities

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. A code issue vulnerability exists in Red Hat OpenShift that stems from a lack of IP address and network range validation, which could...

PT-2025-51747

Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9 Description The software contains a blind server-side request forgery issue that allows attackers to inject XML. This can be triggered by manipulating the shortdesc parameter in the episode upload form, enabling...

CVE-2025-52196

Server-Side Request Forgery SSRF vulnerability in Ctera Portal 8.1.x 8.1.1417.24 allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe...

PT-2025-51557

Name of the Vulnerable Software and Affected Versions ose-openshift-apiserver affected versions not specified Description A flaw exists in ose-openshift-apiserver that permits internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service DoS. Thi...

WordPress plugin Fancy Product Designer has vulnerabilities related to competition conditions.

WordPress Fancy Product Designer plugin is an e-commerce plugin designed for the WordPress platform, mainly used to implement the product online customization function. A server-side request forgery vulnerability exists in the WordPress Fancy Product Designer plugin, which stems from the presence...

Podcast Generator security vulnerabilities

Podcast Generator is PodcastGenerator's open source set of free podcast publishing scripts written in PHP. A security vulnerability exists in Podcast Generator version 3.2.9, which stems from a blind server-side request forgery that could allow an attacker to inject XML into the episode upload fo...

WordPress RSS Aggregator by Feedzy Code Issue Vulnerability

WordPress RSS Aggregator by Feedzy is a lightweight plugin designed for WordPress that focuses on automatically grabbing content from external RSS feeds and syndicating it to your website. WordPress RSS Aggregator by Feedzy has a code issue vulnerability that stems from the existence of a blind...

Penetration Testing of Agentic AI: A Comparative Security Analysis across Models and Frameworks

Agentic AI introduces security vulnerabilities that traditional LLM safeguards fail to address. Although recent work by Unit 42 at Palo Alto Networks demonstrated that ChatGPT-4o successfully executes attacks as an agent that it refuses in chat mode, there is no comparative analysis in multiple...

CTERA Portal security vulnerabilities

CTERA Portal is an enterprise-grade cloud data management platform from CTERA. A security vulnerability exists in Ctera Portal version 8.1.x, which stems from improper handling of HTML files and could lead to server-side request forgery...

SAP BusinessObjects Business Intelligence SSRF

The vulnerability of SAP BusinessObjects Business Intelligence platform is related to incorrect coding or filtering of output data. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

CVE-2025-66407 Weblate has Server-Side Request Forgery vulnerability

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is...

CVE-2025-66407 Weblate has Server-Side Request Forgery vulnerability

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is...