PT-2026-30399

Summary The plugin/Live/test.php endpoint accepts a URL via the statsURL parameter and fetches it server-side using file get contents, curl exec, or wget, returning the full response content in the HTML output. The only validation is a trivial regex /^http/ that does not block requests to...

EUVD-2024-48269

Malicious code in bioql PyPI...

EUVD-2024-47923

Malicious code in bioql PyPI...

CVE-2025-57055: Server-Side Request Forgery (SSRF)

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery SSRF in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curlexec without sufficient validation,...

CVE-2025-57055

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery SSRF in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curlexec without sufficient validation,...

CVE-2024-7330

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

CVE-2024-48232

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in a Server-side request forgery SSRF vulnerability that can read serv...

CVE-2024-48232

The mipjz content management system version 5.0.5 is vulnerable to a Server-side request forgery (SSRF) vulnerability. The root cause is located in the mipPost method of the app\{settingackslash controllerackslash ApiAdminTool.php file, where the postAddress parameter is not processed and is di...

CVE-2024-48234

The mipjz content management system (version 5.0.5 ) is vulnerable to a Server-side request forgery (SSRF) vulnerability. The issue exists in the push method of the app ag controller ApiAdminTag.php file, where the postAddress parameter is not properly processed. Instead, it is passed directly in...

CVE-2024-48234

An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in Server-side request forgery SSRF vulnerability that can read server file...

CVE-2024-48232: Server-Side Request Forgery (SSRF)

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in a Server-side request forgery SSRF vulnerability that can read serv...

CVE-2024-48234: Server-Side Request Forgery (SSRF)

An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curlexec execution and output, resulting in Server-side request forgery SSRF vulnerability that can read server file...

CVE-2024-7330

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

CVE-2024-7330: Server-Side Request Forgery (SSRF)

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

CVE-2024-7330 YouDianCMS ydLib.php curl_exec server-side request forgery

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

CVE-2024-7330

Summary: CVE-2024-7330 affects YouDianCMS v7, where the url argument in the function curl_exec located at /App/Core/Extend/Function/ydLib.php can be manipulated to perform server-side request forgery (SSRF). The vulnerability is exploitable remotely, and public disclosures exist. The available co...

CVE-2024-7330 YouDianCMS ydLib.php curl_exec server-side request forgery

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

YouDianCMS 代码问题漏洞

YouDianCMS YouDian CMS is a website builder from China YouDian Company. A code issue vulnerability exists in YouDianCMS version 7, which stems from the parameter url in the file curlexec /App/Core/Extend/Function/ydLib.php that can lead to server-side request forgery...

CVE-2024-6937

A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curlexec of the file /admin/forms/optionlists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to...

CVE-2024-6937 formtools.org Form Tools Import Option List edit.php curl_exec file inclusion

A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curlexec of the file /admin/forms/optionlists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to...