CVE-2026-74842

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842 Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

EUVD-2026-60078

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842

A server-side request forgery (SSRF) vulnerability exists in the Image-Toolkit-MCP-Server component of Kira-Pgr PromptShopMCP (up to commit 5bc0cd17358e19a5415d11a531088170d7b81452). The download_image function in server.py fails to properly validate the image_url argument, allowing a remote atta...

CVE-2026-74842

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842 Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842: Server-Side Request Forgery (SSRF)

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2019-17095: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In ord...

Bypass Access Restriction

The openstack-glance package is vulnerable to access restriction bypass. When Glance downloadimage policy is enforced for cached system images, it allows an authenticated user to guess the image by its UUID and download that image,against the downloadimage policy. It only affects the setups makin...