285 matches found
Sub-folderFetcher
子文件夹获取器 🐣 一个用于从GitHub下载特定Vulhub仓库文件夹（kibana/CVE-2018-17246）的脚本。 🚀 环境要求 curl unzip 🛠️ 使用方法 root@kitploit: chmod +x subfetcher.sh ./subfetcher.sh...
CVE-2026-53717
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...
CVE-2026-55073
A flaw was found in WeasyPrint. Server-side applications that configure a restrictive URL fetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. This allows an attacker to read local files or perform Server-Si...
CVE-2026-55073
WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...
CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
PT-2026-89206
Summary url fetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two write pdf channels ignore the document's url fetcher and build a fresh default URLFetcher instead. A restricti...
CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...
CVE-2026-82757
CVE-2026-82757 is a Server-Side Request Forgery (SSRF) vulnerability in the Elixir package ash_authentication_oauth2_server , affecting versions from 0.3.0 before 0.3.1. The flaw resides in the public_ip?/1 function of AshAuthentication.Oauth2Server.CIMD.ReqFetcher, which incorrectly classifies I...
EEF-CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforce...
CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...
CVE-2026-82476
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-82476
Memos through 0.30.0 is affected by an SSRF vulnerability in its link-metadata fetcher. The root cause is the omission of the 100.64.0.0/10 carrier-grade NAT address range from the server's IP validation logic. An unauthenticated remote attacker can exploit this to make the server request interna...
CVE-2026-82476 Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
EUVD-2026-68132
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
PT-2026-83455
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-78385
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...
CVE-2026-78385 RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...
EUVD-2026-64886
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...
CVE-2026-50190
Shaarli versions prior to 0.16.3 are vulnerable to stored XSS in the permalink handler of BookmarkListController.php, where raw bookmark titles are emitted unescaped into the document . An attacker who controls a remote page's title can have it fetched verbatim when an admin bookmarks the URL, pl...