CVE-2026-91750

WeKnora before 0.7.0 (developed by Tencent) is vulnerable to SSRF via unvalidated HTTP redirects. The flaw resides in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, which fails to re-validate redirect targets after the initial SSRF check when downloading documents from user-supplied...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - 未认证的服务端请求伪造 描述 WordPress 插件 Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player 在所有版本（最高至 2.0.82，含 2.0.82）中均存在服务端请求伪造漏洞。这使得未认证的攻击者能够发起源自 Web 应用程序并指向任意位置的网络请求，从而可以利用这些请求查询和修改内部服务的信息。 详情 类型 ：插件 标识 ：radio-player 受影响的版本 ：2.0.82 CVSS 分数 ：7.2 CVSS 评...

EUVD-2026-76990

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90769

Open Notebook before 1.11.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/sources endpoint. The application fails to validate the URL parameter, allowing any authenticated user to supply arbitrary URLs that the server will fetch directly. This enables attackers to r...

PT-2026-90836

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF 与 Timing Attack 概念验证 此 Python 脚本是针对 SAP BusinessObjects Launchpad 执行 SSRF（服务器端请求伪造）和 Timing Attack 的概念验证（PoC）。旨在帮助安全研究人员和专业人员在目标 IP 上通过利用 SAP BusinessObjects 的身份验证机制来识别开放端口。 特性 SSRF 利用： 通过针对指定 IP 地址上的不同端口，利用 SSRF 与内部服务交互。 Timing Attack： 测量 SAP BusinessObjects...

CVE-2026-89242

WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a server-side request forgery (SSRF) in the _json_decode function, which fetches remote URLs and local file paths without validation. An unauthenticated attacker can POST file paths or HTTP URLs to login.json.php...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2026-63642

MagicMirror² 日历模块中的 SSRF 针对 CVE-2026-63642 和 CVE-2026-63643 的概念验证漏洞利用，这是 MagicMirror² 日历模块中的服务器端请求伪造漏洞，允许任何未经身份验证的攻击者强制服务器向内部服务发起任意 HTTP 请求。 安装： root@kitploit: $ npm init -y $ npm install socket.io-client 用法： root@kitploit: CVE-2026-63642 - 基础 SSRF $ node cve-2026-63642.js CVE-2026-63643 - 带 TLS...

CVE-2023-27163

CVE-2023-27163 这是 CVE-2023-27163 的一个 PoC，该漏洞是 request-baskets 中直至 v1.2.1 版本存在的一个 SSRF 漏洞。 该漏洞允许攻击者通过 /api/baskets/name 访问敏感的网络资源。 request-baskets 包含一项功能，用户可以在其中指定另一台服务器来转发请求。 这里的问题在于，用户还可以指定非预期的服务，例如网络封闭的内部应用程序。 使用方法 root@kitploit: $ python3 CVE-2023-27163.py --help 用法: python3 CVE-2023-27163.py...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87996

Open WebUI (self-hosted AI platform), versions 0.9.6 through 0.11.1 , is affected by an SSRF via DNS rebinding in the SafePlaywrightURLLoader component (backend/open_webui/retrieval/web/utils.py). The root cause is a trust mismatch: a user-controlled hostname is validated in Python, but the Playw...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-19304

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

EUVD-2026-71266

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

CVE-2026-85662 Marqo 2.26.0 Server-Side Request Forgery via Media URLs

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...

EUVD-2026-71118

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...