Lucene search
+L

5286 matches found

OSV
OSV
added 2026/03/23 8:30 p.m.8 views

GHSA-F35R-V9X5-R8MC New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

Summary The video proxy endpoint GET /v1/videos/:taskid/content is vulnerable to an Insecure Direct Object Reference IDOR. Any authenticated user who knows another user's taskid can retrieve that user's generated video content because the handler queries tasks by taskid alone and does not verify...

6.5CVSS5.8AI score0.00274EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2026/03/22 4:58 p.m.43 views

CVE-2026-33294 AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint plugin/BulkEmbed/save.json.php fetches user-supplied thumbnail URLs via urlgetcontents without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with...

5CVSS0.00271EPSS
SaveExploits1References2
CVE
CVE
added 2026/03/22 4:58 p.m.22 views

CVE-2026-33294

CVE-2026-33294 affects WWBN AVideo prior to version 26.0. The BulkEmbed plugin’s save.json.php fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection, unlike other URL-fetching endpoints which use isSSRFSafeURL(). An authenticated attacker with BulkEmbed permission ca...

5CVSS5.9AI score0.00271EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/03/22 4:58 p.m.12 views

CVE-2026-33294 AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint plugin/BulkEmbed/save.json.php fetches user-supplied thumbnail URLs via urlgetcontents without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with...

5CVSS5.9AI score
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/03/22 4:58 p.m.3 views

CVE-2026-33294 AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint plugin/BulkEmbed/save.json.php fetches user-supplied thumbnail URLs via urlgetcontents without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with...

5CVSS5.9AI score0.00271EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/03/21 6:30 a.m.11 views

EUVD-2026-14161

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS5.8AI score0.00231EPSS
SaveExploits0References6
NVD
NVD
added 2026/03/21 4:17 a.m.7 views

CVE-2026-2720

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS0.00231EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/03/21 3:27 a.m.10 views

CVE-2026-2720

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS5.8AI score0.00231EPSS
SaveExploits0References6
CVE
CVE
added 2026/03/21 3:27 a.m.16 views

CVE-2026-2720

The Hr Press Lite WordPress plugin is vulnerable due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to 1.0.2, allowing authenticated users with Subscriber-level access and above to fetch sensitive employee data (names, emails, phone numbers, salary/pay rat...

6.5CVSS5.8AI score0.00231EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/03/21 3:27 a.m.32 views

CVE-2026-2720 Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS0.00231EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/03/21 3:27 a.m.3 views

CVE-2026-2720 Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS5.8AI score0.00231EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/03/21 12:0 a.m.9 views

PT-2026-26842

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

6.5CVSS5.8AI score0.00231EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/03/20 8:45 p.m.13 views

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

Summary The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template e.g., through a web application that accepts user-supplied templates...

6AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/03/20 8:45 p.m.23 views

GHSA-PGX6-7JCQ-2QFF PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

Summary The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template e.g., through a web application that accepts user-supplied templates...

6.8CVSS6AI score
SaveExploits0References2
NVD
NVD
added 2026/03/20 2:16 a.m.11 views

CVE-2026-32812

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetchmetadata.php accepts an arbitrary URL via $GET'url', validates it only...

6.8CVSS0.00428EPSS
SaveExploits1References3
CVE
CVE
added 2026/03/20 1:58 a.m.34 views

CVE-2026-32812

Admidio CVE-2026-32812 affects versions 5.0.0–5.0.6 where the SSO Metadata API endpoint at modules/sso/fetch_metadata.php reads a user-supplied URL and passes it to file_get_contents() after only PHP FILTER_VALIDATE_URL validation. This allows an authenticated administrator to cause Local File Re...

6.8CVSS5.8AI score0.00428EPSS
SaveExploits1References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/20 1:58 a.m.3 views

CVE-2026-32812 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetchmetadata.php accepts an arbitrary URL via $GET'url', validates it only...

6.8CVSS5.8AI score0.00428EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/03/20 1:58 a.m.6 views

CVE-2026-32812

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetchmetadata.php accepts an arbitrary URL via $GET'url', validates it only...

6.8CVSS5.8AI score0.00428EPSS
SaveExploits1References4Affected Software1
Cvelist
Cvelist
added 2026/03/20 1:58 a.m.43 views

CVE-2026-32812 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetchmetadata.php accepts an arbitrary URL via $GET'url', validates it only...

6.8CVSS0.00428EPSS
SaveExploits1References3
OSV
OSV
added 2026/03/20 1:58 a.m.15 views

CVE-2026-32812 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetchmetadata.php accepts an arbitrary URL via $GET'url', validates it only...

6.8CVSS5.8AI score
SaveExploits0References5
Rows per page
Query Builder