matrix-media-repo code issues and vulnerabilities

matrix-media-repo is a highly configurable multi-domain media repository for Matrix open source by t2bot.io. A code issue vulnerability exists in matrix-media-repo versions prior to v1.3.8 that stems from vulnerability to a server-side request forgery attack that, under certain conditions, serves...

PT-2025-2932 · Unknown +1 · Gomatrixserverlib +1

Name of the Vulnerable Software and Affected Versions: Gomatrixserverlib affected versions not specified Description: Gomatrixserverlib is a Go library for matrix federation. It is vulnerable to server-side request forgery, serving content from a private network it can access, under certain...

PT-2025-2933 · Unknown +1 · Matrix Media Repo +1

Name of the Vulnerable Software and Affected Versions: Matrix Media Repo MMR versions prior to 1.3.8 Description: Matrix Media Repo MMR is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This issue allows MMR to serve...

gomatrixserverlib code issue vulnerabilities

gomatrixserverlib is a Go library from the Matrix Foundation. It is used for common functions required by Matrix servers. A code issue vulnerability exists in Gomatrixserverlib that stems from vulnerability to server-side request forgery attacks...

CVE-2024-57767

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery SSRF via the component /file/download...

PT-2025-34632

Name of the Vulnerable Software and Affected Versions: PhpOffice/PhpSpreadsheet versions prior to 1.30.0 PhpOffice/PhpSpreadsheet versions prior to 2.1.12 PhpOffice/PhpSpreadsheet versions prior to 2.4.0 PhpOffice/PhpSpreadsheet versions prior to 3.10.0 PhpOffice/PhpSpreadsheet versions prior to...

PT-2025-4460 · Learndash · Faizaan Gagan Course Migration For Learndash

Name of the Vulnerable Software and Affected Versions: Faizaan Gagan Course Migration for LearnDash versions 1.0.2 through n/a Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentiall...

WUZHI CMS code-related vulnerabilities

WUZHI CMS is a PHP and MySQL based open source content management system CMS from WUZHI. A code issue vulnerability exists in WUZHI CMS version 4.1.0, which stems from the parameter sphinxhost/sphinxport being susceptible to server-side request forgery attacks...

Mysiteforme security vulnerabilities

Mysiteforme is a permissions management system for wangl1989 individual developers. A security vulnerability exists in Mysiteforme versions prior to 2025.01.01, which stems from a discovery via the component /file/download that contains a server-side request forgery vulnerability...

Stripo Inc: [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier

A critical Blind SSRF Server-Side Request Forgery vulnerability was identified in the export service of the Stripo app. The vulnerability existed in the endpoint /exportservice/v3/exports/WEBHOOK/accounts, where malicious input could be provided in the webhookUrl parameter, triggering SSRF and...

Veeam Backup code-related vulnerabilities

Veeam Backup is a backup software from Veeam USA. A code issue vulnerability exists in Veeam Backup versions prior to 7.1.0.59 that stems from vulnerability to server-side request forgery SSRF attacks, which could allow an unauthenticated attacker to send unauthorized requests from the system...

SonicOS SSH SSRF

The vulnerability of the SSH configuration function in SonicOS operating systems is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Security Bulletin: Due to use of IBM WebSphere Application Server, IBM Workload Automation is vulnerable to a server-side forgery attack,

Summary IBM WebSphere Application Server is used by IBM Workload Automation CVE-2024-22354 Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External...

WordPress plugin Greenshift has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Bookstore security vulnerabilities

bookstore is an e-commerce bookstore system by donglight individual developer. A security vulnerability exists in bookstore version 1.0.0, which originates from the parameter url in the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java that can lead to a server-side request forgery attack...

WordPress Greenshift plugin <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross-Site Scripting vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Greenshift versions = 9.0.0...

CVE-2024-13195 donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the argument url leads to server-side request forgery. It is possible to initia...

PT-2025-2053 · Unknown · Donglight Bookstore

Name of the Vulnerable Software and Affected Versions: donglight bookstore versions 1.0.0 Description: A critical issue affects the getHtml function of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the url argument leads to server-side request forgery, allowing...

I, Librarian Code Issues and Vulnerabilities

I, Librarian is a library management program by Martin Kucej, a personal developer. A security vulnerability exists in I, Librarian version 5.11.1 and earlier, which stems from improper input validation in classes/security/validation.php and is vulnerable to server-side request forgery attacks...

Intersec Geosafe-ea buffer error vulnerability

Intersec Geosafe-ea is an application from Intersec France. A security vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14, which stems from the presence of an XML External Entity Injection vulnerability that could allow an attacker to perform an arbitrary file read...