PT-2025-44086

Name of the Vulnerable Software and Affected Versions Auto Featured Image Auto Post Thumbnail plugin for WordPress versions prior to 4.1.8 Description The Auto Featured Image Auto Post Thumbnail plugin for WordPress is susceptible to Server-Side Request Forgery SSRF in versions up to and includin...

CVE-2025-62505

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...

CVE-2025-62505 SSRF in lobehub/lobe-chat with native web fetch module

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...

PT-2025-42638

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 1.136.2 Description LobeChat is susceptible to a server-side request forgery SSRF issue within the tools.search.crawlPages tRPC endpoint. An attacker can provide arbitrary URLs and specify the 'naive' implementation,...

CVE-2025-9975

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wpscraperextractcontent function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary...

EUVD-2025-33850

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wpscraperextractcontent function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary...

CVE-2025-9975

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wpscraperextractcontent function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary...

CVE-2025-9975

The WP Scraper WordPress plugin is affected by a Server-Side Request Forgery (SSRF) in versions up to 5.8.1 via the wp_scraper_extract_content function. Exploitation requires authenticated access at Administrator level or higher and allows the attacker to make web requests from the application to...

CVE-2025-9975 WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wpscraperextractcontent function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary...

PT-2025-41684

Name of the Vulnerable Software and Affected Versions WP Scraper plugin for WordPress versions prior to 5.8.2 Description The WP Scraper plugin for WordPress is susceptible to Server-Side Request Forgery SSRF in versions up to and including 5.8.1. This flaw resides within the wp scraper extract...

EUVD-2024-43173

Malicious code in bioql PyPI...

EUVD-2021-29907

Malicious code in bioql PyPI...

CVE-2025-34233 Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a protection mechanism failure vulnerability within the filegetcontents function. When an administrator configures a printer’s hostname or...

CVE-2025-54122: Server-Side Request Forgery (SSRF)

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

CVE-2025-53018

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the "/api/v2/Photo::fromUrl" endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-53018: Server-Side Request Forgery (SSRF)

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the RequestsToolkit module. An attacker can access internal network resources, perform port scans, retrieve sensitive metadata from cloud environments, and interact with local services by crafting...

Server-side Request Forgery (SSRF)

Overview langchain is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the RequestsToolkit module. An attacker can access internal network resources, perform port scans, retrieve sensitive metadata fro...

CVE-2025-2828

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...

CVE-2025-2828: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...