CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - 認証済み（購読者以上）サーバーサイドリクエストフォージェリ 説明: WordPress用プラグイン「Magical Addons For...

wargame_Re-LS

Desafío CTF CVE-2025-0184 DOCX SSRF Inicio Rápido root@kitploit: 1. 설정 및 빌드 make setup make build 2. 서비스 시작 make up 3. 웹 접속 open http://localhost:8080 Objetivo ¡Accede al servicio Admin interno puerto 3003 y obtén la bandera! Bandera esperada : CTFflagreadme Exploit root@kitploit: cd exploits...

CVE-2022-25260

CVE-2022-25260 JetBrains Hub 预认证半盲服务器端请求伪造（SSRF） 使用要求 JetBrains Hub 2021.1.14276 2021.1.14276 之前的 JetBrains Hub 存在访问控制不当问题（CVE-2022-34894），即使禁用了访客用户，攻击者也能在未认证的情况下创建不受信任的服务。这使得无需任何其他条件即可利用该漏洞（通常情况下，攻击者至少需要经过身份验证）。 使用方法 安装并运行： root@kitploit: $ git clone https://github.com/yuriisanin/CVE-2022-25260 ...

blind-ssrf-chains

介绍 什么是服务端请求伪造（SSRF）？ 服务端请求伪造发生在当你能够迫使服务器代表你发起任意请求时。由于请求是由服务器发起的，因此有可能根据服务器在网络中的位置访问内部资源。在云环境中，由于存在可能包含敏感凭证或密钥的元数据端点，SSRF 构成了更重大的风险。 盲 SSRF 在利用服务端请求伪造时，我们常常会发现自己处于无法读取响应的情况。在行业中，这种行为通常被称为“盲 SSRF”。在这种情况下，我们如何证明其影响？这是由 Justin Gardner 在 Twitter 上引发的一场有趣的讨论： 最近我发现了大量的盲...

poc-cve-2026-32255

Kan 附件下载 SSRF 漏洞（CVE-2026-32255）- 概念验证 本仓库包含针对 CVE-2026-32255 的概念验证（POC），这是开源项目管理工具 Kan 中存在的一个高严重性服务端请求伪造（SSRF）漏洞。 该漏洞端点允许未认证攻击者从服务器发起任意 HTTP 请求并读取完整响应，从而能够访问内部服务和云元数据端点。 目录 1. 漏洞详情 2. 运行 POC 3. 使用漏洞利用脚本 4. 如何修复漏洞 5. 免责声明 漏洞详情 CVE 信息 CVE ID ：CVE-2026-32255 受影响版本 ：Kan .env 'EOF'...

CVE-2021-40438-POC

注：教育目的および管理されたテスト目的のみを対象としています。許可を得ているシステムでのみテストしてください。 CVE-2021-40438 - SSRFエクスプロイト root@kitploit: ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄ ░▀▀▀░░▀░░▀▀▀░░░░░▀▀▀░░▀░░▀▀▀░▀▀▀░░░░░░░▀░░▀░░░░▀░▀▀░░░▀░ 使用方法 root@kitploit: 基本的な使い...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

EUVD-2026-76054

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

EUVD-2026-75180

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader...

PT-2026-89173

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85650

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...

EUVD-2026-71140

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85242

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning

Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...