22396 matches found
Blind-SSRF-CVE-2020-15002
ملخص المنطق في AddFileAction.getImageDataFromUrl لجلب الصور من عناوين URL خارجية عند معالجة /appsuite/api/oxodocumentfilter&action=addfile المنفذ هنا يتحقق من عناوين URL المعاد توجيهها فقط بعد اتباع جميع عمليات إعادة التوجيه response = httpClient.executegetRequest, context; int statusCode =...
CVE-2023-23169
CVE-2023-23169 POC لـ CVE-2023-23169: تضمين الملفات المحلية LFI وتزوير الطلبات من جانب الخادم SSRF خطوات إعادة الإنتاج: تضمين الملفات المحلية LFI: 1. echo "" poc.docx 2. ارفع الملف في خدمة PDFocus 3. اعرض/حمّل الملف بعد ذلك لتشغيل الإثبات تزوير الطلبات من جانب الخادم SSRF: 1. echo "" poc.docx 2...
CVE-2023-39024-5-POC
إثبات المفهوم لـ CVE-2023-39024 و CVE-2023-39025 إثبات المفهوم لـ CVE-2023-39024 و CVE-2023-39025 Harman Media Suite نظرة عامة التطبيق المتأثر: Harman Media Suite الإصدارات المتأثرة: 4.2.0 وما دون الوصف: تطبيق Harman Media Suite الإصدارات 4.2.0 وأقل عرضة لثغرة تزوير الطلب من جانب الخادم SSRF...
CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token...
CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token...
CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token...
WordPress Broken Link Notifier plugin 1.3.1-2.0.0.0 - Unauthenticated SSRF vulnerability
Unauthenticated SSRF vulnerability discovered by Amin Guliyev in WordPress Plugin Broken Link Notifier versions 1.3.1-2.0.0.0...
SAP Solution Manager 7.2 - Remote Command Execution
SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...
EUVD-2026-91835
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...
PT-2026-104583
Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A server-side request forgery SSRF issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use ...
PT-2026-104587
SuiteCRM has a public SSRF proof of concept. CVE-2026-69137. The catch everyone's missing: "authenticated" doesn't mean privileged. Any valid user account is enough. 👉 Full breakdown: https://t.co/XtKhwXuTVg SuiteCRM SSRF CyberSecurity AppSec InfoSec WebSecurity https://t.co/U6cfGAFuxo...
CVE-2026-105122: Server-Side Request Forgery (SSRF)
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token...
SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4417-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4417-1 advisory. - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction...
GHSA-X8GV-G2G3-65FJ SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF | Field | Value | |---|---| | Disclosed by | joysinleung [email protected] | | Report date | 2026-08-13 | | Product | SiYuan 思源笔记 — siyuan-note/siyuan | | Go module |...
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF | Field | Value | |---|---| | Disclosed by | joysinleung [email protected] | | Report date | 2026-08-13 | | Product | SiYuan 思源笔记 — siyuan-note/siyuan | | Go module |...
CVE-2026-105048
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...
GHSA-JQMF-MX4F-HFR6 Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...
GHSA-Q567-CR4X-96W4 Trigger.dev: Blind SSRF via alert-channel webhook
Summary A WEBHOOK alert channel stores a user-supplied url. When an alert fires deployment/run failure, error groups, the webapp server alertsWorker - DeliverAlertService POSTs the HMAC-signed alert payload to that URL via fetchwebhook.url, .... The URL is never validated against a host allowlist...