Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

CVE-2026-108786

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function runseoaudit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been...

CVE-2026-108787

A server-side request forgery (SSRF) vulnerability exists in houtini-ai voice-analyser-mcp up to version 2.1.1 . The flaw is located in the fetch function within the src/utils/crawler.ts file of the collect_corpus component. By manipulating the sitemap_url argument, an attacker can perform remote...

CVE-2026-108786

A vulnerability exists in houtini-ai seo-crawler-mcp up to version 2.1.5 within the Crawler component. The flaw resides specifically in the run_seo_audit function located in the src/core/CrawlOrchestrator.ts file. This vulnerability allows for server-side request forgery (SSRF) and can be launche...

CVE-2026-108770

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Create by TheAlchimist cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

CVE-2026-64849-poc-lab

Security Lab — SSRF Exploitation in MLflow Webhooks CVE-2026-64849 · MLflow Restricted use: lab material, only for authorized networks and environments. See Legal notice. 1. Executive summary Attribute| Value ---|--- Vulnerability| CVE-2026-64849 — SSRF via Webhook Redirect Bypass Affected...

CVE-2022-42889-Text4Shell-POC

CVE-2022-42889 Text4Shell Testing Script This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889. About Text4Shell CVE-2022-42889 Text4Shell is a critical vulnerability that affects a wide ran...

CVE-2026-108572

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572

A server-side request forgery (SSRF) vulnerability exists in Casdoor up to versions 3.164.0 and 4.10.0 . The flaw is located in the CasP3ProxyValidate function within the controllers/cas.go file of the Proxy Validation component. An attacker can remotely manipulate the pgtUrl argument to trigger ...

CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108542

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotel...

CVE-2026-108542

A server-side request forgery (SSRF) vulnerability exists in the 021is elvix-sdk up to version 0.10.1 . The flaw is located within an unknown functionality of the src/mcp/index.ts file in the MCP Request Handler component. By manipulating the argument path , an attacker can execute the attack rem...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 es una herramienta de descubrimiento de subdominios que encuentra y resuelve subdominios válidos y luego realiza fuzzing de SSRF/LFI/SQLi, fuerza bruta y escaneo de puertos. Tiene una...

CVE-2026-108523

The Studio-Saelix Sencho software (up to version 0.94.1 ) contains a Server-Side Request Forgery (SSRF) vulnerability in the git-sources Browse API Endpoint component, specifically affecting the outboundTarget.ts file. Manipulation of the repo_url argument can trigger the SSRF, which may be execu...

CVE-2026-108523 Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...