Next.js Improper Middleware Redirect Handling Leads to SSRF

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next. In self-hosted applications, this could allow Server-Side Request Forgery SSRF if certain sensitive headers from the incoming request...

Next.js code issues and vulnerabilities

Next.js is a React framework open-sourced by Vercel. A code issue vulnerability exists in versions of Next.js prior to 14.2.32 and 15.4.7, which stems from improper use of the next function and could lead to server-side request forgery...

PT-2025-35322

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.32 and prior to 15.4.7 Description Next.js is a React framework for building full-stack web applications. When the next function was used without explicitly passing the request object in self-hosted applications,...

CVE-2025-31971

AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery SSRF attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information...

CVE-2025-53250 WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Chartbeat Chartbeat allows Server Side Request Forgery. This issue affects Chartbeat: from n/a through 2.0.7...

CVE-2025-53250

CVE-2025-53250 corresponds to a Server-Side Request Forgery in the WordPress Chartbeat Plugin (versions n/a–2.0.7). The CVSS 3.1 base metrics indicate a Network attack vector, Low attack complexity, Low privileges required, no user interaction, with Confidentiality and Integrity impacts both Low ...

CVE-2025-48364 WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through = 0.4.2...

CVE-2025-48364

CVE-2025-48364 is a Server-Side Request Forgery (SSRF) vulnerability impacting the WordPress rajce plugin (vEnCa-X) versions n/a through 0.4.2. According to the sources, the issue affects rajce up to 0.4.2 and has a CVSS v3.1 base score of 4.9 (Network, High attack complexity, Low privileges, No ...

HCL AIML Solutions for SXVersions 1: Total security vulnerabilities

HCL AIML Solutions for SXVersions 1 Total is an extension for intelligent services and predictive capabilities from HCL India. A security vulnerability exists in HCL AIML Solutions for SXVersions 1 Total version 1.0, which stems from improper URL validation and could lead to server-side request...

WordPress plugin Rajce has code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin Chartbeat: code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Solace Extra versions = 1.3.2...

CVE-2025-58203

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

PT-2025-34950 · Sangfor · Iam +2

Name of the Vulnerable Software and Affected Versions: Sangfor Behavior Management System affected versions not specified Description: The Sangfor Behavior Management System also referred to as DC Management System contains an XML external entity XXE injection vulnerability in the /src/sangforind...

PT-2025-34917 · WordPress · Solacewp Solace Extra

Name of the Vulnerable Software and Affected Versions: solacewp Solace Extra versions through 1.3.2 Description: A Server-Side Request Forgery SSRF vulnerability exists in solacewp Solace Extra, allowing Server Side Request Forgery. Recommendations: At the moment, there is no information about a...

WordPress plugin Solace Extra code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2017-1000190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SimpleXML latest version 2.7.1 is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. CVE-2017-1000190 Note that Nessus...

ROS-20250827-07

A vulnerability in GLPI's asset management and data center management software is related to improper neutralization of HTML tags associated with scripts on a web page. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code GLPI asset and data center...