CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2026-111899

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

EUVD-2026-104319

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899

KitchenOwl versions through 0.7.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the recipe import functionality. The flaw allows authenticated household members to bypass IP filtering by exploiting an unfiltered fetch. Specifically, an attacker can host a page titled KitchenOwl a...

CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Unauthenticated Server-Side Request Forgery Description The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept exploit for CVE-2026-63642 and CVE-2026-63643, Server-Side Request Forgery vulnerabilities in MagicMirror²'s Calendar module that allow any unauthenticated attacker to force the server to make arbitrary HTTP requests to internal services...

CVE-2023-27163

CVE-2023-27163 This is a PoC for CVE-2023-27163 which is a SSRF vulnerability present in request-baskets upto v1.2.1. This vulnerability allows attackers to access sensitive network resources via /api/baskets/name. The request-baskets contains a functionality where a user can specify another serv...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-0311

A Server-Side Request Forgery (SSRF) vulnerability exists in Palo Alto Networks Checkov by Prisma® Cloud . This flaw allows a local unauthenticated user to trigger unauthorized network requests from the host to internal services. As a workaround , users should avoid running Checkov over untrusted...

CVE-2026-55385

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385

The InvoiceShelf web and mobile application is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.4.0 . The root cause lies in PDFConfigurationRequest.php, which only performs syntactic validation on the owner-controlled gotenberg_host setting. Consequently, GotenbergPDFDrive...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, and...

CVE-2026-110628

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

EUVD-2026-101256

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...