CVE-2022-28117

CVE-2022-28117 Navigate CMS = 2.9.4 - Server-Side Request Forgery Autenticato Descrizione Una Server-Side Request Forgery SSRF nella classe feedparser di Navigate CMS v2.9.4 consente a un attaccante remoto di forzare l'applicazione a effettuare richieste arbitrarie tramite l'iniezione di URL...

CVE-2024-23692

Vulnerabilità CVE-2024-23692 di Rejetto HFS HTTP File Server Panoramica Rejetto HFS HTTP File Server è un semplice server web per la condivisione di file che facilita la condivisione di file su una rete o su Internet. Nonostante la sua facilità d'uso e semplicità, è stata scoperta una vulnerabili...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 SSRF بدون مصادقة CVE-2024-48360 | Qualitor = v8.24 SSRF بدون مصادقة الوصف Qualitor هي منصة لإدارة عمليات الأعمال، ويتواجد هذا النظام في العديد من الشركات في البرازيل التي يمكن تحديدها ببساطة باستخدام Google dorking. حدد فريقنا ثغرة في التطبيق معرّضة لـ SSRF، والت...

CVE-2025-45955

CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Beschreibung Ein Angreifer kann diese Schwachstelle ausnutzen, indem er eine speziell präparierte PHP-Datei auf der Ferozo-Hosting-Plattform hochlädt und ausführt. Beim Zugriff startet die Datei eine Reihe von...

CVE-2018-10933-POC

CVE-2018-10933-POC تجاوز libSSH تم العثور على ثغرة أمنية في آلة الحالة على جانب الخادم لـ libssh قبل الإصدارين 0.7.6 و0.8.4 إنها POC بسيطة هنا في الكود، استبدل و وفقًا لذلك...

react2shell-CVE-2025-55182

Il componente Attack contiene il codice dell'attacco. Basta decommentarlo e premere il pulsante per eseguire l'attacco. Per eseguire il tuo codice sul server exploit basta cambiare il valore della chiave prefix nel payload. Vedi il file AttackString per esempi...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Benvenuto in React Router! Un modello moderno e pronto per la produzione per creare applicazioni React full-stack utilizzando React Router. Caratteristiche 🚀 Rendering lato server ⚡️ Sostituzione a caldo dei moduli HMR 📦 Bundle e ottimizzazione degli asset 🔄 Caricamento dati e mutazioni 🔒...

CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

EUVD-2026-65228

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-56708

The Grav API plugin before version 1.0.16 is affected by a server-side request forgery (SSRF) vulnerability in its webhook delivery mechanism. The root cause is a DNS rebinding attack that bypasses hostname validation: an attacker who controls the authoritative DNS for a configured webhook hostna...

EUVD-2026-65197

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2024-5736

CVE-2024-5736 AdmirorFrames Joomla! Estensione 5.0 - Falsificazione di richiesta lato server Cronologia Vulnerabilità segnalata al fornitore: 26.01.2024 Nuova versione corretta 5.0 rilasciata: 06.06.2024 Divulgazione pubblica: 28.06.2024 Descrizione Falsificazione di richiesta lato server in...

rwsploit

Oracle Reports rwservlet स्कैनर ⚠️ केवल अधिकृत उपयोग के लिए। इस टूल को केवल उन सिस्टमों पर चलाएँ जिनके स्वामी आप हैं या जिनके परीक्षण के लिए आपके पास स्पष्ट लिखित अनुमति है। अनधिकृत उपयोग अवैध है। Oracle Reports Server rwservlet के लिए एक केंद्रित शोषण स्कैनर जो CVE-2012-3152 और CVE-2012-3153 को...

CVE-2025-55853

CVE-2025-55853 - Inclusão de Arquivo Local via Falsificação de Solicitação do Lado do Servidor O SoftVision webPDF anterior à versão 10.0.2 é vulnerável a Falsificação de Solicitação do Lado do Servidor SSRF. Sobre Esta PoC para CVE-2025-55853 demonstra Falsificação de Solicitação do Lado do...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform يحتوي على ثغرة SSTI تؤدي إلى حقن تعليمات برمجية عشوائية لجميع المستخدمين الذين لديهم صلاحية تحرير نموذج عنوان الإرسال. الإصدارات المتأثرة هي v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not found. % endif % سيكون ق...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

awx: notification backends allow SSRF and credential leakage

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-49452

A flaw was found in WeasyPrint, a tool designed to create PDF documents from web content. When processing untrusted HTML with presentational hints enabled, WeasyPrint embeds unescaped HTML attribute values directly into CSS declarations. This vulnerability allows a remote attacker to inject...

Security Bulletin: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Summary Langflow OSS includes outbound network request functionality for provider validation and API request execution. Weaknesses in request destination validation and enforcement could allow authenticated users to induce requests to unintended internal or external network locations, which may...