CVE-2025-13814

The CVE affects moxi159753 Mogu Blog v2 up to 5.2. The vulnerability is in LocalFileServiceImpl.uploadPictureByUrl (file /file/uploadPicsByUrl) and enables server-side request forgery. Exploitation can be performed remotely and, per sources, a public PoC exists; vendor did not respond to disclosu...

CVE-2025-13809

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

EUVD-2025-199957

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

CVE-2025-13809

Summary: CVE-2025-13809 affects orionsec orion-ops (SSH Connection Handler) via the MachineInfoController, where manipulating arguments host/sshPort/username/password/authType can trigger server-side request forgery. The vulnerability is described across multiple sources as exploitable from remot...

CVE-2025-13809 orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

CVE-2025-13809 orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

EUVD-2025-199940

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

CVE-2025-13796

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

Deco Apps Library / MCP Server Code Issues and Vulnerabilities

Deco Apps Library / MCP Servers is a content management system from deco.cx open source. A code issue vulnerability exists in Deco Apps Library / MCP Servers version 0.120.1 and earlier, which stems from incorrect manipulation of the parameter url in the file website/loaders/analyticsScript.ts,...

PT-2025-48419

Name of the Vulnerable Software and Affected Versions moxi159753 Mogu Blog versions up to 5.2 Description A security issue exists in moxi159753 Mogu Blog v2. The LocalFileServiceImpl.uploadPictureByUrl function, located in the /file/uploadPicsByUrl file, is susceptible to server-side request...

AI Gateway code-related vulnerabilities

AI Gateway is an AI gateway open source by Portkey.ai. A code issue vulnerability exists in AI Gateway versions prior to 1.14.0, which stems from an SSRF vulnerability that could lead to external resource access...

PT-2025-48542

Name of the Vulnerable Software and Affected Versions PublicCMS version 5.202506.b Description PublicCMS version 5.202506.b is susceptible to a Server-Side Request Forgery SSRF condition. This issue is located within the chat interface of the SimpleAiAdminController. SSRF occurs when an applicati...

CVE-2025-65836

PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController...

CVE-2025-65836

The open-source Java-based content management system PublicCMS version V5.202506.b is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists within the chat interface of the SimpleAiAdminController component. This vulnerability allows an attacker to cause the application to make reque...

CVE-2025-65836

PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController...

PT-2025-48413

Name of the Vulnerable Software and Affected Versions orionsec orion-ops versions up to 5925824997a3109651bbde07460958a7be249ed1 Description A server-side request forgery condition exists in the SSH Connection Handler component of orionsec orion-ops. The issue is related to the manipulation of th...

CVE-2025-13796 deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

CVE-2025-13796 deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

CVE-2025-13796

CVE-2025-13796 affects deco-cx apps up to 0.120.1, specifically the AnalyticsScript function in website/loaders/analyticsScript.ts of the Parameter Handler component. The issue arises from improper handling of the url argument, enabling server-side request forgery (SSRF) and remote exploitation. ...

EUVD-2025-199932

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used...