CVE-2022-31188

CVE-2022-31188 CVE-2022-31188 - OpenCV CVAT Computer Vision Annotation Tool SSRF CVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with "Task Create" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other...

SUSE CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. Follow me on...

CVE-2026-119545

A flaw was found in Forgejo. A remote, unauthenticated attacker can conduct Server-Side Request Forgery SSRF by submitting an arbitrary OpenID identifier to the login endpoint. This issue forces the server to send unverified HTTP requests to internal addresses, loopback interfaces, or cloud...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119428 phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119428

Versions of phpMyAdmin through 5.2.3 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the setup/validate.php component. The vulnerability exists because the file lacks a setup-disabled guard , allowing unauthenticated attackers to trigger outbound connections. By sending a POST requ...

CVE-2026-119428 phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119428: phpMyAdmin: phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

PT-2026-133481

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-115720

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115720 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

EUVD-2026-109785

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115720 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115720

Frappe Builder versions before 1.36.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in builder/api.py. The root cause is that the assert_not_private_url() guard only validates the initial hostname, while subsequent requests.get(url) calls follow redirects by default without...

CVE-2026-115720 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

Mattermost server request forgery vulnerability

Mattermost versions 11.7.10 and earlier in the 11.7.x series contain a server-side request forgery vulnerability. This vulnerability stems from the lack of outbound internal connection filtering applied to requests directed at the OpenID discovery endpoint. As a result, system administrators may ...

CVE-2026-114634 WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL because getheaders follows redirects without re-validating targets with isSSRFSafeURL. Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET...