32752 matches found
CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65466
CVE-2026-65466 concerns a Server Side Request Forgery (SSRF) in the WordPress JetBooking plugin <= 4.1.2 . The description specifies a custom role -driven SSRF vulnerability affecting JetBooking versions up to 4.1.2. The CVSSv3.1 metrics (source: Patchstack) indicate a network attack vector , ...
EUVD-2026-48078
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-24639
The CVE-2026-24639 entry concerns the WordPress Photo Block plugin (
EUVD-2026-48146
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
CVE-2026-15017
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...
Exploit for Server-Side Request Forgery in Lollms
CVE-20...
CVE-2026-15017
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJMPermissions::setpermissions and MDJMEmployeeManager::init functions, combined with the...
CVE-2026-15017
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 1.7.8.4. The root cause is missing capability checks and nonce verification in MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init(), combined with the absence of server-side...
CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...
CVE-2026-64799 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
EUVD-2026-47915
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
Server-Side Request Forgery
Spring Boot Admin Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied healthUrl and managementUrl parameters during instance registration, allowing unauthenticated attackers to force the server to send HTTP requests to...
PT-2026-63889
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
PT-2026-64033
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The title template and body template fields are rendered using an unsandboxed jinja2.Environment, allowi...
PT-2026-64095
Server-Side Request Forgery SSRF in upload ad image via Unrestricted image url Fetch Summary The upload ad image MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled image url parameter directly to an HTTP fetch helper httpx.AsyncClientfollow redirects=True.geturl without any scheme,...