Server-side Request Forgery (SSRF)

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the allowAbsoluteUrls attribute being ignored in the call to the buildFullPath function from the HTTP adapter. An...

WordPress plugin Better Messages has a code vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2025-1662

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...

WordPress plugin URL Media Uploader code vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2024-13907

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2024-13905

The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and...

WordPress plugin Total Upkeep: Code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin OneStore Sites code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Sucms security vulnerabilities

Sucms is a completely open source and free PHP+MYSQL system by China Subianji team. A security vulnerability exists in Sucms v1.0, which stems from a server-side request forgery in the adminwebgather.php component that allows access to internal data and services...

WordPress OneStore Sites plugin <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery vulnerability

Unauthenticated Blind Server-Side Request Forgery vulnerability discovered by Francesco Carlucci in WordPress Plugin OneStore Sites versions = 0.1.1...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

PT-2025-8710

Name of the Vulnerable Software and Affected Versions JizhiCMS version 2.5.4 Description The issue is related to a Server-Side Request Forgery SSRF in the PluginsController.php component. This allows attackers to perform an intranet scan by sending a crafted request. Recommendations For JizhiCMS...

emlog security vulnerabilities

emlog is a PHP and MySQL based CMS website builder by emlog's individual developers. A security vulnerability exists in emlog Pro version v2.5.4, which originates from the sort.php component and is susceptible to server-side request forgery attacks...

CVE-2024-30150

HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery SSRF and Denial of ServiceDOS attacks from unauthenticated users...

CVE-2024-13695

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachmentid' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

WordPress Enfold plugin code vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

VulnCheck KEV: CVE-2024-38514

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery SSRF vulnerability due to a lack of validation of the endpoint GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance MKCOL, PUT and GET...

USN-7280-1 python3.10, python3.12, python3.8 vulnerability

It was discovered that Python incorrectly handled parsing domain names that included square brackets. A remote attacker could possibly use this issue to perform a Server-Side Request Forgery SSRF attack...

WordPress Embed Any Document plugin <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode vulnerability

Authenticated Contributor+ Blind Server-Side Request Forgery via embeddoc Shortcode vulnerability discovered by theviper17y in WordPress Plugin Embed Any Document versions = 2.7.5...

Pigeon Code Issues and Vulnerabilities

Pigeon is a lightweight message board/notepad/social system/blog by the individual developer Akkariin Meiko. A code issue vulnerability exists in Pigeon version 1.0.177, which stems from a parameter url in the file /pigeon/imgproxy/index.php that can lead to server-side request forgery...