CVE-2025-32102

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...

CVE-2025-29458: Server-Side Request Forgery (SSRF)

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2024-56736

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto (CVE-2025-27152, CVE-2025-29774, CVE-2025-29775 and CVE-2024-57965)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto. Vulnerability Details CVEID:CVE-2025-27152...

CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

CVE-2024-56736

Apache HertzBeat (incubating) versions prior to 1.7.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Api Config Oss component. This flaw allows an attacker to potentially induce the server to make unintended requests. To remediate this issue, users are recommended...

CVE-2025-3691

A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-3691 mirweiye Seven Bears Library CMS Add Link server-side request forgery

A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-3691

CVE-2025-3691 affects mirweiye Seven Bears Library CMS (2023) via the Add Link Handler. Reported vulnerability is server-side request forgery (SSRF) that can be triggered remotely. Several sources confirm remote exploitation and public disclosure; no explicit patch details are provided in the sup...

CVE-2025-3691 mirweiye Seven Bears Library CMS Add Link server-side request forgery

A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-29720

Dify v1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component controllers.console.remotefiles.RemoteFileUploadApi...

CVE-2024-56736: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

PT-2025-16625 · Unknown · Mirweiye Seven Bears Library Cms

Name of the Vulnerable Software and Affected Versions: mirweiye Seven Bears Library CMS version 2023 Description: A vulnerability was found in the Add Link Handler component, which can lead to server-side request forgery. The manipulation can be launched remotely. Recommendations: For mirweiye...

PT-2025-16783 · Apache · Apache Hertzbeat

Name of the Vulnerable Software and Affected Versions: Apache HertzBeat versions prior to 1.7.0 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. It affects the Api Config Oss. Users are recommended to upgrade to version 1.7.0 to fix the issue. Recommendations: For...

DNN < 9.13.8 DotNetNuke.Core Server-Side Request Forgery (CVE-2025-32372)

According to its self-reported version, the instance of DNN formerly DotNetNuke running on the remote web server is prior to 9.13.8. It is, therefore, affected by a server-side request forgery vulnerability: - DNN formerly DotNetNuke is an open-source web content management platform CMS in the...

Kyverno vulnerable to SSRF via Service Calls

Summary An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrate data. Details According to the documentation, Service Call is intended to address services located insi...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...