CVE-2025-54924

The CVE-2025-54924 entry concerns Schneider Electric EcoStruxure Power Monitoring Expert. A SSRF flaw in the GetPagesAsImages function allows remote attackers to disclose sensitive information. Unauthenticated exploitation is implied by ZDI notes; No published patch/version is specified in the pr...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in WebhookUtil.java. An attacker can access or manipulate internal server resources by sending crafted requests that are processed by the server. Remediation Upgrade org.apache.eventmesh:eventmesh-runtim...

GHSA-HF86-8X8V-H7VC Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes th...

CVE-2024-39954

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2025-5260

Server-Side Request Forgery SSRF vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5...

CVE-2024-39954

The org.apache.eventmesh:eventmesh-runtime component is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) within the WebhookUtil.java file. The root cause is the improper validation of user-supplied URLs due to unsafe handling in the module, which allows an attacker to send crafted req...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2025-5260 SSRF in PozitifIK's Pik Online

Server-Side Request Forgery SSRF vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5...

WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin rajce versions = 0.4.2...

PT-2025-34179

Name of the Vulnerable Software and Affected Versions nbconvert versions up to and including 7.16.6 Description The nbconvert tool, used for converting Jupyter notebooks to various formats, has an issue on Windows systems. Converting a notebook with SVG output to PDF can lead to unauthorized code...

PositiveIK Pik Online code issues and vulnerabilities

PozitifIK Pik Online is an online exam application from PozitifIK, Inc. A security vulnerability exists in PozitifIK Pik Online versions prior to 3.1.5 that stems from vulnerability to server-side request forgery attacks...

Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation Advanced Reporting and Dashboard Module code-related vulnerabilities

Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation AdvancedReporting and Dashboards Module are products of Schneider Electric, France. Schneider Electric EcoStruxure Power Monitoring Expert is a device for power distribution monitoring in IoT...

PT-2025-33964 · Unknown · Pik Online

Name of the Vulnerable Software and Affected Versions: Pik Online versions prior to 3.1.5 Description: Pik Online contains a Server-Side Request Forgery SSRF vulnerability. This allows for Server-Side Request Forgery. Recommendations: Update Pik Online to version 3.1.5 or later...

PT-2025-34062

Name of the Vulnerable Software and Affected Versions: IBM Edge Application Manager version 4.5 Description: IBM Edge Application Manager is susceptible to a server-side request forgery SSRF issue. An authenticated attacker may be able to send unauthorized requests from the system, potentially...

Linux Distros Unpatched Vulnerability : CVE-2022-26499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests such as GET to interfaces such as...

WordPress B Slider plugin server-side request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress B Slider plugin suffers from a server-side request forgery vulnerability that stems from the fsapirequest function not implementing an adequate validation mechanis...

Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation Advanced Reporting and Dashboard Module code-related vulnerabilities

Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation AdvancedReporting and Dashboards Module are products of Schneider Electric, France. Schneider Electric EcoStruxure Power Monitoring Expert is a device for power distribution monitoring in IoT...

Server-side Request Forgery (SSRF)

Overview johnbillion/wp-crontrol is a package that allows you to take control of the cron events on your WordPress website. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the wpremoterequest function. An attacker can send arbitrary HTTP requests from the...

PT-2025-33892 · WordPress · Wp Crontrol

Name of the Vulnerable Software and Affected Versions: WP Crontrol versions 1.17.0 through 1.19.1 Description: The WP Crontrol plugin for WordPress is vulnerable to Server-Side Request Forgery via the wp remote request function. This allows authenticated attackers with Administrator-level access...