CVE-2025-68705

CVE-2025-68705 - Exploit de Path Traversal en RustFS Descripción Este script explota una vulnerabilidad de path traversal CVE-2025-68705 en RustFS que permite leer archivos arbitrarios en el servidor. Requisitos Python 3.6+ Consulta requirements.txt para las dependencias Instalación git clone...

CVE-2026-103309

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled...

EUVD-2026-94760

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

CVE-2024-6386-WPML-SSTI

This repository does not have a README...

CLEANSTART-2026-AF62012 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

PT-2026-108114

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff rtsp connect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

PT-2026-107827

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 STEP 1: Demo vulnerable web-app LAB We create logic similar to CVE-2025-55182 unsafe server-side execution. 📁 vulnapp/app.py from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data = request.json.get"component" ❌ VULNERABLE: user...

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

NPM: Next.js has Server-Side Request Forgery in Image Optimization

NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

EUVD-2026-43178

PraisonAI: Crawl4AI/Chromium backend is also affected by the webcrawl SSRF validation bypass...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-band verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — Server-Side Request Forgery in Next.js via WebSocket upgrade requests. ⚠️ For authorized security testing only. You are responsible for ensuring you have permission to test every target you pass to this script...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...