FC3er

FC3er | CVE-2022-0591 - Formcraft3 CVE-2022-0591 - Formcraft3 install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 使用方法 bash fc3er.sh yourlist.txt thread 参照 https://vulners.com/cve/CVE-2022-0591...

fubucker

Fubucker | CVE-2022-1386 - Fusion Builder 自动批量检查CVE-2022-1386漏洞的工具 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 安装 JQ Linux : 命令 apt-get install jq -y Windows : 对于WSL，只需像Linux一样安装；对于GitBash，你可以执行以下命令 命令 curl -L -o C:/Program...

CVE-2022-1386

CVE-2022-1386 - Fusion Builder 3.6.2 - 未认证SSRF 描述 Fusion Builder 是一个 WordPress 插件，允许用户使用拖放界面创建和编辑页面。它存在一个未认证的 SSRF 漏洞，攻击者可以利用此漏洞读取服务器上的任意文件。 概念验证 请求： POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:98.0 Gecko/20100101 Firefox/98.0...

CVE-2023-22047

描述： CVE-2023-22047 是 Oracle PeopleSoft 上的一个未授权文件读取漏洞。然而，高级攻击者可以利用此漏洞执行远程代码。 在 PeopleSoft 应用 "Portal.war" 中，Servlet "WSRP Consumer ResourceProxy" 允许读取文件并向任意主机发起请求（SSRF）。 借助此漏洞，攻击者可以轻松在受影响的服务器上实现远程代码执行（RCE），这表明其实际严重程度超过了分配的 CVSS 评分。 利用步骤 https://peoplesoft.local:8443/RP?wsrp-url=file:///etc/passwd...

CVE-2026-34160

CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...

CVE-2026-33715

CVE-2026-33715 — Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php Severity : High CVSS 7.2 CWE : CWE-918 SSRF + CWE-306 Missing Authentication Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-mxc9-9335-45mc NVD :...

CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-61793 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

VulnCheck KEV: CVE-2026-40242

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation...

CVE-2026-92566

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...

EUVD-2026-78675

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

WordPress Total processing card payments for WooCommerce plugin <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure vulnerability

Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Nomupay Payment Processing Gateway versions = 7.3...

CVE-2026-16947 Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can reach the...

WordPress Simple Google Calendar Outlook Events Widget plugin < 3.1.0 - Unauthenticated SSRF via calendar_id vulnerability

Unauthenticated SSRF via calendarid vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Simple Google Calendar Outlook Events Block Widget versions 3.1.0...

WordPress Mailgun for WordPress plugin <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) vulnerability

Unauthenticated Server-Side Request Forgery SSRF vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin Mailgun for WordPress versions = 2.2.0...

CVE-2026-75053

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint...

EUVD-2026-56534

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...