10034 matches found
CVE-2025-1833 zj1983 zz HTTP Request Customer_noticeAction.java sendNotice server-side request forgery
A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customernotice/CustomernoticeAction.java of the component HTTP Request Handler. The manipulation of the argumen...
CVE-2025-1662
The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...
PT-2025-9219 · Zj1983 · Zj1983
Name of the Vulnerable Software and Affected Versions: zj1983 zz versions up to 2024-8 Description: A critical issue has been found in the function sendNotice of the file src/main/java/com/futvan/z/erp/customer notice/Customer noticeAction.java of the component HTTP Request Handler. The...
CVE-2025-1799
A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack...
CVE-2025-1799 Zorlan SkyCaiji Tool.php previewAction server-side request forgery
A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack...
CVE-2025-1799 Zorlan SkyCaiji Tool.php previewAction server-side request forgery
A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack...
CVE-2025-1799
CVE-2025-1799 affects Zorlan SkyCaiji 2.9, impacting the file vendor/skycaiji/app/admin/controller/Tool.php in the function previewAction . The issue is a manipulated argument leading to server-side request forgery (SSRF) , with remote exploitation possible and public disclosure of exploits. Mult...
CVE-2024-13697
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nicelinks'. This makes it possible for unauthenticated attackers to make web request...
CVE-2024-13697 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nicelinks'. This makes it possible for unauthenticated attackers to make web request...
CVE-2024-13697
CVE-2024-13697 documents an unauthenticated SSRF in Better Messages for WordPress (plugin versions up to 2.7.4) via the nice_links feature. Exploitation requires Enable link previews (default). The connected docs indicate a patch is available and advise upgrading to a fixed version; no further ex...
CVE-2024-13697 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nicelinks'. This makes it possible for unauthenticated attackers to make web request...
CVE-2024-13907
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level...
CVE-2024-13905
The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and...
CVE-2025-25760
A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...
CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...
PT-2025-9182 · Unknown · Zorlan Skycaiji
Name of the Vulnerable Software and Affected Versions: Zorlan SkyCaiji version 2.9 Description: A critical vulnerability was found in Zorlan SkyCaiji, affecting the previewAction function of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the data argument leads to...
PT-2025-9168 · WordPress · The Better Messages
Name of the Vulnerable Software and Affected Versions: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress versions up to, and including, 2.7.4 Description: The issue allows unauthenticated attackers to make web requests to arbitrary...
Exploit for Server-Side Request Forgery in Bookstackapp Bookstack
PHP filter chains: file read from error-based oracle. Updated...
CVE-2025-1662
The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...