GHSA-MXHQ-XW3G-RPHC lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Summary The latest version of lobe-chatby now v0.141.2 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. Details visit https://chat-preview.lobehub.com/settings/agent you...

CVE-2024-1467

The CVE-2024-1467 vulnerability affects the Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress. It is a Server-Side Request Forgery (SSRF) vulnerability exploitable by authenticated attackers with contributor-level access and above via the ai_api_request() fu...

CVE-2024-3047

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3047

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3047 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3047

Technical details (affected product/version, root cause, impact, remediation) are not provided in the Connected documents. Monitor for updates from vendors or official advisories to obtain concrete details and mitigation.

WordPress plugin PDF Invoices & Packing Slips for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. A security vulnerability exists i...

CVE-2024-3047: Server-Side Request Forgery (SSRF)

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

Piotnet Addons For Elementor Pro <= 7.1.17 - Unauthenticated Server-Side Request Forgery

Description The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.17. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application...

CVE-2024-2663

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-0216

The CVE-2024-0216 entry for Google Doc Embedder (WordPress) is a SSRF vulnerability in the gview shortcode present in WordPress plugin versions up to 2.6.4. Reported impact states that authenticated users with contributor permissions can cause the application to make outbound requests to arbitrar...

CVE-2024-0216: Server-Side Request Forgery (SSRF)

The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating...

CVE-2024-2663: Server-Side Request Forgery (SSRF)

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

PT-2024-21432 · WordPress · Zd Youtube Flv Player

Name of the Vulnerable Software and Affected Versions: ZD YouTube FLV Player plugin for WordPress versions up to, and including, 1.2.6 Description: The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to que...

Really Simple SSL < 8.0.0 - Admin+ Server-Side Request Forgery

Description The Really Simple SSL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.2.3. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating...

PDF Invoices & Packing Slips for WooCommerce < 3.8.1 - Unauthenticated Server-Side Request Forgery

Description The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from...

CVE-2023-6805

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

CVE-2023-6805: Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...