PT-2025-9016 · Elestio · Elestio Memos

Name of the Vulnerable Software and Affected Versions: elestio memos version 0.23.0 Description: The issue is related to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. This vulnerability allows attackers to...

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

CVE-2025-22952

Elestio Memos (v0.23.0) is affected by CVE-2025-22952: a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs. The Nuclei template confirms the issue as applicable to MEMOS versions up to 0.24.0 and notes that unauthenticated attackers can exploit SSRF to access...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25827

CVE-2025-25827 describes a Server-Side Request Forgery (SSRF) in the sort.php component of Emlog Pro v2.5.4 that allows an attacker to scan local and internal ports by supplying a crafted URL. The CVSS base score is 6.8 (Medium) with Impact to confidentiality and Privilege level: none , indicatin...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25785

CVE-2025-25785 affects JizhiCMS v2.5.4 through a Server-Side Request Forgery (SSRF) in the c\PluginsController.php component. The vulnerability enables an attacker to initiate an intranet scan via a crafted request. The reported impact is high confidentiality and integrity risk (C/H, I/H) with no...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2024-30150

HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery SSRF and Denial of ServiceDOS attacks from unauthenticated users...

CVE-2024-30150 An unauthenticated privilege escalation vulnerability affects HCL MyCloud

HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery SSRF and Denial of ServiceDOS attacks from unauthenticated users...

CVE-2024-30150 An unauthenticated privilege escalation vulnerability affects HCL MyCloud

HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery SSRF and Denial of ServiceDOS attacks from unauthenticated users...

CVE-2024-49336

IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2024-13695

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachmentid' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

CVE-2024-13695 Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachmentid' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

CVE-2024-13695

CVE-2024-13695 : The Enfold WordPress theme (versions up to and including 6.0.9) is vulnerable to Server-Side Request Forgery via the attachment_id parameter. Exploitation requires authenticated access at Subscriber level or higher, enabling web requests originating from the vulnerable instance t...