CVE-2025-5818 Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...

PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image...

CVE-2025-54445: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue affects MagicINFO 9 Server: less than 21.1080.0...

PT-2025-30523 · Unknown · Private-Ip

Name of the Vulnerable Software and Affected Versions: private-ip affected versions not specified Description: The package is susceptible to a Server-Side Request Forgery SSRF issue. An attacker can exploit this by providing an IP address or hostname that resolves to a multicast IP address...

PT-2025-30533 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: The software contains an Improper Restriction of XML External Entity Reference vulnerability that allows Server Side Request Forgery. Recommendations: Update MagicINFO 9 Server to...

FastReport.NET XML External Object Reference SSRF

The vulnerability of the FastReport.NET report and document generation library is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to files and perform a SSRF attack...

Adobe Commerce/Magento Open Source Multiple Vulnerabilities (APSB24-40)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...

CVE-2025-46385

CWE-918 Server-Side Request Forgery SSRF...

CVE-2025-34142

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

Exploit for Server-Side Request Forgery in Fusion_Builder_Project Fusion_Builder

CVE-2022-1386 – Fusion Builder Example: bash python3...

Server Side Request Forgery (SSRF)

org.glassfish.main.admingui, console-common is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of user-supplied URLs in specific endpoints, which allows an attacker to make arbitrary requests to internal or external systems on behalf of the server...

CVE-2025-34142: Improper Restriction of XML External Entity Reference

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

CVE-2025-54122 Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

CVE-2025-54122

The CVE-2025-54122 entry concerns Manager-io/Manager accounting software with an unauthenticated SSRF in the proxy handler used by both Desktop and Server editions. Affected versions go up to 25.7.18.2519; the vulnerability allows bypassing network isolation and reaching internal services or clou...

CVE-2025-52362

Server-Side Request Forgery SSRF vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL...

CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...

PT-2025-30343

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions up to and including 25.7.18.2519 Description Manager-io/Manager is accounting software with a critical unauthenticated Server-Side Request Forgery SSRF vulnerability identified in the proxy handler component. This...

CVE-2025-36845: Server-Side Request Forgery (SSRF)

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /internal/redirect.php allows for Server-Side Request Forgery SSRF. The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only...