CVE-2024-39954: Server-Side Request Forgery (SSRF)

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2025-8680 B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery

The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fsapirequest function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to...

CVE-2025-7622

During an internal security assessment, a Server-Side Request Forgery SSRF vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered...

CVE-2025-7622

During an internal security assessment, a Server-Side Request Forgery SSRF vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered...

CVE-2025-7622

CVE-2025-7622 describes a Server-Side Request Forgery (SSRF) vulnerability affecting Axis Camera Station/Axis Camera Station Pro, observed during internal security assessments. The authenticated attacker could access internal server resources via SSRF. The core issue is an SSRF condition that ena...

AXIS Camera Station和AXIS Camera Station Pro 安全漏洞

AXIS Camera Station and AXIS Camera Station Pro are both a powerful and flexible video management and access control from Axis Sweden. A security vulnerability exists in AXIS Camera Station and AXIS Camera Station Pro that stems from server-side request forgery and could lead to access to interna...

CVE-2025-7622: Server-Side Request Forgery (SSRF)

During an internal security assessment, a Server-Side Request Forgery SSRF vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered...

CVE-2025-25229

Omnissa Workspace ONE UEM is affected by a Server-Side Request Forgery (SSRF) vulnerability (CVE-2025-25229). The issue could allow a user with privileges to access restricted internal information and enumerate internal network resources via API endpoints. The connected documents corroborate the ...

Server-Side Request Forgery (SSRF)

webfinger.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient restriction on localhost access because the lookup function fails to block requests to local or internal network services, allowing attackers to craft requests targeting internal resources...

PT-2025-32560 · Omnissa · Workspace One Uem

Name of the Vulnerable Software and Affected Versions: Omnissa Workspace ONE UEM affected versions not specified Description: Omnissa Workspace ONE UEM contains a Server-Side Request Forgery SSRF vulnerability. A malicious actor with user privileges may be able to access restricted internal syste...

CVE-2025-8355

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery SSRF...

CVE-2025-4581

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the...

PT-2025-31002

Name of the Vulnerable Software and Affected Versions ChanCMS versions up to 3.1.2 Description A critical server-side request forgery SSRF vulnerability exists in the getPages function of the /cms/collect/getPages file. Manipulation of the targetUrl argument can lead to unauthorized access to...

PT-2025-30523 · Unknown · Private-Ip

Name of the Vulnerable Software and Affected Versions: private-ip affected versions not specified Description: The package is susceptible to a Server-Side Request Forgery SSRF issue. An attacker can exploit this by providing an IP address or hostname that resolves to a multicast IP address...

CVE-2025-53018 Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the RequestsToolkit module. An attacker can access internal network resources, perform port scans, retrieve sensitive metadata from cloud environments, and interact with local services by crafting...

CVE-2024-7073

A server-side request forgery SSRF vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the networ...

CVE-2024-7073

A server-side request forgery SSRF vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the networ...

PT-2025-23538

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description A server-side request forgery SSRF issue exists due to improper input validation in SOAP admin services. This allows unauthenticated attackers to manipulate server-side requests, enabli...

CVE-2025-48739

A Server-Side Request Forgery SSRF vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote authenticated attackers with admin permissions allowing them to access specific API endpoints to manipulate URLs to direct...