29 matches found
CVE-2026-88403
A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...
CVE-2026-88403
A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...
CVE-2026-88403: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...
PT-2026-92031
An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/online upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-79425: Server-Side Request Forgery (SSRF)
An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-79425
An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...
EUVD-2026-36785
A Server-Side Request Forgery SSRF in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl...
EUVD-2026-36784
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
GHSA-GMXH-HJFV-QC2W Koillection has an authenticated Server-Side Request Forgery issue
An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...
CVE-2026-50886: Improper Access Control
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-50887
A Server-Side Request Forgery (SSRF) vulnerability exists in the shlink v5.0.1 software. The flaw is located in the automatic short URL title resolution component , where an attacker can provide a crafted longUrl variable to scan internal resources. No remediation or newer version containing a fi...
CVE-2026-36757
A Server-Side Request Forgery SSRF in the /plugins/name/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-38527
A Server-Side Request Forgery SSRF in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request...
CVE-2026-36758
A Server-Side Request Forgery SSRF in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-36758
A Server-Side Request Forgery SSRF in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-36758
A Server-Side Request Forgery SSRF in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-36756
A Server-Side Request Forgery SSRF in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-36757
A Server-Side Request Forgery SSRF in the /plugins/name/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request...
CVE-2026-36757
A Server-Side Request Forgery (SSRF) vulnerability exists in the halo v2.22.14 website building tool. The flaw is located in the /plugins/{name}/upgrade-from-uri endpoint, where it allows authenticated attackers to scan internal resources by sending a crafted GET request . While the vulnerability...
