CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

HPESBNW04886 rev.1 - HPE Telco Service Orchestrator Software, Server-Side Request Forgery (SSRF) Vulnerability

Potential Security Impact: Remote: Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-27817 |...

WordPress Amazon Products to WooCommerce plugin <= 1.2.7 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ch4r0n in WordPress Plugin Amazon Products to WooCommerce versions = 1.2.7...

CVE-2025-34051

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051

Multiple firmware versions of AVTECH DVR devices are vulnerable to a Server-Side Request Forgery (SSRF) . The vulnerability stems from an unauthenticated /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint. An attacker can manipulate the ip , port , and queryb64str parameters to force the DVR to...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

PT-2025-27535 · Avtech · Avtech Dvr

Name of the Vulnerable Software and Affected Versions: AVTECH DVR devices affected versions not specified Description: A server-side request forgery issue exists in AVTECH DVR devices, exposing the "/cgi-bin/nobody/Search.cgi?action=cgi query" endpoint without authentication. An attacker can...

CVE-2025-45872

The ZrLog blogging system (version 3.1.5 ) is vulnerable to a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. This flaw allows an attacker to perform unauthorized requests, potentially providing access to internal resources. As a temporary workaround, it is recommended to restri...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

BIT-ELK-2025-25012 Kibana Open Redirect

URL redirection to an untrusted site 'Open Redirect' in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL...

Server Side Request Forgery (SSRF)

github.com/octo-sts/app is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation and sanitization of OpenID Connect token fields, allowing attackers to craft tokens that trigger internal network requests...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

PT-2025-27409 · Apache · Apache Eventmesh

Name of the Vulnerable Software and Affected Versions: Apache EventMesh versions prior to 1.12.0 Description: This issue is a Server-Side Request Forgery SSRF within the eventmesh-runtime module, specifically in the WebhookUtil.java file, affecting Windows, Linux, and macOS operating systems. The...

PT-2025-27471 · Akamai · Akamai Cloudtest

Name of the Vulnerable Software and Affected Versions: Akamai CloudTest versions prior to 60 2025.06.09 Description: The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external resources. No...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

CVE-2025-52491

CVE-2025-52491 affects Akamai CloudTest prior to version 60 2025.06.09 (12989) and allows server-side request forgery (SSRF). The NVD entry lists CVSS 3.1 base score 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Connected sources confirm the affected release and remediation guidance; PT-2025-27471 r...

CVE-2025-53018

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-6762

A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely...