CVE-2026-25738

Indico SSRF (CVE-2026-25738) affects Indico versions before 3.3.10. Outgoing requests to user-provided URLs can access sensitive targets (e.g., localhost, cloud metadata). Impact is limited by access controls (only event organizers can see returned data); non-AWS IPs are less affected. remediatio...

CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of...

Indico 跨站脚本漏洞

Indico is an open-source event management system with rich functionality. Versions of Indico prior to 3.3.10 had a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of certain file types during upload, which could lead to cross-site scripting attacks...