CVE-2025-5350

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery SSRF. Additionally, the...

CVE-2025-5350

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery SSRF. Additionally, the...

CVE-2025-5350

CVE-2025-5350 affects WSO2 products via the deprecated Try-It feature. The vulnerability is caused by insufficient validation of user-supplied URLs, enabling SSRF and reflected XSS in the admin context when an administrator is tricked into visiting a crafted link. The SSRF could reach internal se...

EUVD-2025-35829

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery SSRF. Additionally, the...

EUVD-2025-35827

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes ...

CVE-2025-12136 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes ...

Server-Side Request Forgery (SSRF)

Flowise is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied URLs in the /api/v1/fetch-links endpoint, which allows an attacker to exploit the server as a proxy to access internal network resources and explore their link structures...

PT-2025-43609

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description The Try-It feature, accessible to administrative users, contains server-side request forgery SSRF and reflected cross-site scripting XSS issues. The feature does not properly validate...

MAL-2025-48849 Malicious code in internal-test-utils-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in internal-test-utils-test (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48848 Malicious code in internal-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14723fa9c85ed09e8669f1e402756b97ce2654f9e2b222a57ca6d539d73afc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14723fa9c85ed09e8669f1e402756b97ce2654f9e2b222a57ca6d539d73afc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-runtime-test (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48847 Malicious code in internal-runtime-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in internal-runtime (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48846 Malicious code in internal-runtime (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in internal-links-autocomplete-id (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-48693 Malicious code in internal-links-autocomplete-id (npm)

The package communicates with a domain associated with malicious activity...

EUVD-2025-35677

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...

CVE-2025-11128

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...