CVE-2026-64849-poc-lab

安全实验室 — MLflow Webhooks 中的 SSRF 利用 CVE-2026-64849 · MLflow 使用限制： 实验室材料，仅限授权网络和环境使用。参见 法律声明。 1. 执行摘要 属性| 值 ---|--- 漏洞| CVE-2026-64849 — 通过 Webhook 重定向绕过实现 SSRF 受影响组件| MLflow Tracking Server 3.15.0 实验室版本| MLflow 3.13.0（未修改，通过 pip install 安装） 根本原因| TOCTOU：验证 URL，跟随 302 而不重新验证 攻击向量| HTTP；无需身份验证 声明严重性...

CVE-2026-86237 openagents-org openagents http.py test_default_model server-side request forgery

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...

EUVD-2026-72185

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...

PT-2026-86834

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible t...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests 由 TheAlchimist 创建 root@kitploit: cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

basketcraft

basketcraft 这是一个利用 CVE-2023-27163 漏洞的脚本，该漏洞是 request-baskets 1.2.1 版本中的一个 SSRF。 SSRF on Request-Baskets CVE-2023–27163 CVE-2023–27163 是 Request-Baskets 中一个严重的服务端请求伪造（SSRF）漏洞，影响 1.2.1 及之前的所有版本。该漏洞使恶意行为者能够通过精心构造的 API 请求，利用 /api/baskets/name 组件，未经授权访问网络资源和敏感信息。 工作原理 Request-Baskets 是一个 Web...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge 快速开始 root@kitploit: 1. 配置并构建 make setup make build 2. 启动服务 make up 3. 访问网页 open http://localhost:8080 目标 访问内部 Admin 服务3003 端口以获取 Flag！ 预期 Flag : CTFflagreadme 漏洞利用 root@kitploit: cd exploits python3 exploitgenerator.py 在网页上上传 payloads/adminflag.docx 文件 基于...

CVE-2026-86259

OpenMAIC versions before 1.0.1 contain a server-side request forgery (SSRF) vulnerability in non-production builds where URL validation is gated by environment. Unauthenticated attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter, reaching cloud instance met...

CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

PT-2026-86529

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2025-55182-exploit

⚠️ 免責事項 このツールは、許可されたセキュリティテストおよび教育目的のみに使用してください。 所有しているシステム、または明示的な書面による許可を得たシステムのみをテストしてください。 無許可の使用は違法かつ非倫理的です。 開発者は誤用に対する責任を負いません。 責任を持って、該当するすべての法律に従って使用してください。 🔍 概要 CVE-2025-55182は、experimental-form機能を利用したReact/NextJSアプリケーションにおける重大なサーバーサイドリクエストフォージェリ（SSRF）およびリモートコード実行（RCE）の脆弱性です。...

CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

CVE-2026-86122

Rowboat through version 0.9.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by insufficient validation of custom MCP server and webhook URLs. Authenticated users can configure these URLs to point at internal services and cloud metadata endpoints , enabling enumeration o...

EUVD-2026-71951

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...

CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...

CVE-2025-45955

CVE-2025-45955 DonWeb Ferozo 中的服务端请求伪造 CVE-2025-45955 描述 攻击者可以通过在 Ferozo 托管平台上上传并执行特制的 PHP 文件来利用此漏洞。一旦被访问，该文件会发起一系列 SSRF 尝试，针对内部服务（如 127.0.0.1、169.254.169.254 或服务网格端点）、本地文件（例如 file:///etc/passwd）以及已知云元数据端点。该脚本会收集响应或错误消息，使攻击者能够测绘内部基础设施、枚举可访问的服务，并收集敏感信息以进行进一步利用。 概念验证 PoC 以下代码演示了该漏洞： root@kitploit:...

CVE-2026-4361 Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

EUVD-2026-71858

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

WordPress Greenshift plugin < 13.2.0 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Alireza Kalhor in WordPress Plugin Greenshift versions 13.2.0...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...