CVE-2025-56563

A Server-Side Request Forgery (SSRF) vulnerability exists in the sat_proxy.php script of Zenith Satellite Tracker 1.0 . The root cause is the script's acceptance of an attacker-controlled address URL parameter and its subsequent pass to curl_setopt(CURLOPT_URL) without performing any host or sche...

CVE-2025-56563: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

gdal: Heap-use-after-free in Curl_setopt

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6440122373373952 Project: gdal Fuzzer: aflgdalosrsetfromuserinputfuzzer Fuzz target binary: osrsetfromuserinputfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Cras...

PHPList 2.10.9 'Sajax.php' PHP代码注入漏洞

phplist是一个开源的newsletter管理软件，用PHP开发。 PHPList 'Sajax.php'不正确处理用户提交的数据，远程攻击者可以利用漏洞提交恶意代码，并以WEB权限执行。 0 PHPList 2.10.9 厂商解决方案 phplist ----- 目前没有详细解决方案提供： http://www.phplist.com/ --------------------------------------- This PoC was written for educational purpose. Use it at your own risk. Author will b...