WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

CVE-2026-26801-pdfmake-ssrf

pdfmake SSRF 漏洞 PoC 漏洞概述 字段| 值 ---|--- 软件包| pdfmake 版本| = 0.3.0-beta.2, CREDENTIALS LEAKED! 这证明存在漏洞的服务器向我们的受控端点发起了外部请求。 完整读取 SSRF（npm run exfiltrate） 攻击脚本会生成 exfiltrated.pdf。使用任意 PDF 阅读器打开后，AWS 凭据 JSON 会作为文件附件（metadata.json）嵌入其中。这证明实现了完整的数据窃取，而不仅仅是盲 SSRF。攻击者可以在 PDF 内部获取实际的响应体内容。 实际影响 1...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 CVE-2021-22214 的 POC：Gitlab SSRF 描述 远程 GitLab 安装中存在一个服务器端请求伪造（SSRF）漏洞，原因是内部网络的 webhook 被启用。远程未认证的攻击者可以利用一个注册受限的 GitLab 实例，使其向攻击者选择的任意域名发起 HTTP 请求。 用法 Python 代码 root@kitploit: usage: python3 GitLabSSRF.py Curl 命令 root@kitploit: curl -s –show-error -H 'Content-Type: application/json'...

PT-2026-89562

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

EUVD-2026-75187

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets...

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

Summary An unauthenticated server-side request forgery vulnerability lets any anonymous user make the GeoNetwork server issue arbitrary outbound HTTP requests. This gives an external attacker a position inside the server's network, making it possible to make internal requests no matter if the...

GHSA-5HX7-J24V-RFFJ GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

Summary An unauthenticated server-side request forgery vulnerability lets any anonymous user make the GeoNetwork server issue arbitrary outbound HTTP requests. This gives an external attacker a position inside the server's network, making it possible to make internal requests no matter if the...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF 到 LFI 利用工具 ⚠️ 免责声明 此工具仅供教育和已授权的安全测试使用 此概念验证利用工具仅用于教育目的，帮助安全专业人员了解该漏洞并保护其系统。未经授权访问计算机系统是违法的。作者对因使用此工具产生的任何误用或损害不承担任何责任。在测试前，您必须获得系统所有者的明确书面许可。使用此工具即表示您同意遵守所有适用法律。 📋 目录 1. 概述 2. 漏洞详情 3. 技术深入剖析 4. 利用工具用法 5. 安装与要求 6. 缓解措施 7. 参考资料与致谢 📌 概述...

CVE-2026-87999

Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...

CVE-2026-19233

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

EUVD-2026-74948

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-87821

Lara Dashboard versions 0.9.2 through 1.3.1 are affected by a Server-Side Request Forgery (SSRF) in the POST /api/admin/builder/markdown/fetch endpoint. Any authenticated user can supply a malicious URL without host validation or redirect restrictions , allowing them to read the response body of ...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-79635

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

VMWare-vRealize-SSRF

VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 使用 python CVE-2021-21975.py...

CVE-2026-54048

Apache Impala versions 2.0.0 through 4.5.1 (all platforms) are affected by a server-side request forgery (SSRF) vulnerability in the avro.schema.url table property. An attacker can specify an http:// or file:/// URI, causing Impala to issue a GET request to internal endpoints the attacker cannot ...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange 存在服务端请求伪造漏洞 Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

halo-2.25.4-CVE-2026-67919

Halo 2.25.4 中通过未经验证的插件 URI 安装实现认证远程代码执行（RCE） 1. 漏洞概述 在 Halo 2.25.4 版本中发现了一个严重的安全漏洞。该应用提供了一个管理端点，用于从远程 URI 安装或升级插件。然而，系统未能验证 URI 的源域名，并且在该特定组件上缺乏服务端请求伪造（SSRF）防护。具有插件管理权限的认证攻击者可以提供指向恶意构造的插件 JAR 文件的链接。服务器将使用 PF4J 框架和 Spring 的 DefaultPluginApplicationContextFactory 下载、临时存储并将该 JAR 文件动态加载到 JVM...