EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

LyLme spage v1.9.5 - Server-Side Request Forgery

LyLme spage v1.9.5 is vulnerable to server-side request forgery SSRF via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-36675 info: name: LyLme spage v1.9.5 - Server-Side Request Forgery...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

MeterSphere < 2.5.0 SSRF

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 ssrf 简单利用 golang 练习 影响版本 Exchange Server 2013 小于 CU23 Exchange Server 2016 小于 CU18 Exchange Server 2019 小于 CU7 利用条件 该漏洞不同于以往的 exchange 漏洞，此漏洞并不需要一个可登录的用户身份，可以在未授权的情况下获取内部用户资源，配合 CVE-2021-27065 可以实现远程命令执行。 漏洞触发必要条件 目标服务器存在漏洞 目标 exchange 服务器必须为负载均衡服务器，即同时使用两台及以上服务器...

CVE-2022-41401

OpenRefine = v3.5.2 SSRF OpenRefine v=3.5.2 包含一个服务器端请求伪造（SSRF）漏洞，该漏洞允许未经授权的用户利用系统，可能导致未经授权访问内部资源和敏感文件泄露。 此漏洞的根本原因在于 OpenRefine 对提供的 URL 缺乏充分的服务器端验证。虽然存在客户端验证，但服务器端未能执行相同级别的审查。因此，如果用户最初提供一个有效的 URI，随后将其替换为恶意 URI，服务器端系统将无法检测到这一更改。 PoC 该漏洞可在 OpenRefine...

EUVD-2026-75779

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-81213

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) due to missing egress validation on server-side URL fetches. Multiple components fail to apply the platform's shared SSRF guard: the MCP server configuration URL field, the automatic tool...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

CVE-2021-26855-PoC

CVE-2021-26855-PoC 针对 CVE-2021-26855 的 PoC 漏洞利用代码。 原始代码由 https://github.com/GreyOrder 开发。 CVE-2021-26855 SSRF 简单利用的 golang 练习 受影响版本 root@kitploit: Exchange Server 2013 低于 CU23 Exchange Server 2016 低于 CU18 Exchange Server 2019 低于 CU7 使用条件 此漏洞不同于以往的 Exchange 漏洞。该漏洞不需要可登录的用户身份，无需授权即可获取内部用户资源。它可以与...

CVE-2021-21975

CVE-2021-21975 VMware vRealize Operations Manager API 服务器端请求伪造（SSRF） vRealize Operations vROps 是一款由 AI 驱动的自助式 IT 运维管理工具，覆盖从应用到基础设施的范围，用于优化、规划并扩展 VMware Cloud 和 HCI 部署，同时统一公共云监控。VMware vRealize Operations Manager API 8.4 及所有早期版本 存在服务器端请求伪造（SSRF）漏洞。成功利用此漏洞可能导致读取或更新内部资源，并且在此情况下，攻击者可以轻松窃取 vROps...

CVE-2026-44578-PoC

CVE-2026-44578 - Next.js WebSocket SSRF PoC 漏洞： Next.js WebSocket 升级处理程序中的服务器端请求伪造（13.4.13 → 15.5.15, 16.0.0 → 16.1.6） 使用方法 root@kitploit: Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel to internal Redis python3 poc.py target.com:3000 --internal 127.0.0.1:6379 --payload...

CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra 本地文件包含 LFI 分析 📌 概述 本文档描述了一个影响 Zimbra Collaboration Suite 的本地文件包含 LFI 漏洞。 该问题源于对以下参数的不当处理： root@kitploit: /h/?javax.servlet.include.servletpath= 这允许未经身份验证的用户访问内部应用程序资源。 🔍 漏洞详情 类型： 本地文件包含 LFI 访问权限： 无需身份验证 受影响组件： Webmail（经典界面） 攻击向量： HTTP 请求操纵 🧪 初始验证 测试请求： root@kitploit: cur...

CVE-2026-85675

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-78682

A flaw was found in NLTK. When an HTTP proxy is configured, a server-side request forgery SSRF vulnerability exists in the nltk.pathsec.urlopen function. An attacker can exploit this by providing a seemingly valid public URL, which the proxy then forwards to an internal service without proper...

EUVD-2026-63439

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897...

CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...