CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

EUVD-2026-80792

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380

WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...

CVE-2026-92380: Server-Side Request Forgery (SSRF)

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-49865

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865

Kimai , an open-source time tracking application, versions prior to 2.58.0 are affected by a Server-Side Request Forgery (SSRF) in the invoice PDF preview and generation workflow. The root cause is that user-controlled Markdown fields (e.g., Customer.invoiceText) pass through an md2html filter in...

EUVD-2026-76765

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

Server-side Request Forgery (SSRF)

Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...

CVE-2026-65842

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

PT-2026-57231

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.58.0 Description Kimai contains a server-side request forgery SSRF issue in its invoice PDF preview and generation workflow. This occurs when the server-side PDF renderer fetches remote image URLs embedded in Markdown...

PYSEC-2026-1965 Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

📄 EspoCRM 9.3.3 Server-Side Request Forgery

This Metasploit module exploits an authenticated server-side request forgery vulnerability in EspoCRM versions up to 9.3.3. The vulnerability exists in the Attachment/fromImageUrl API endpoint which allows users to fetch images from remote URLs. By using alternative IPv4 notations octal, hex,...

EUVD-2026-25579

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP...

CVE-2026-39362

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREEDOWNLOADFROMURL is enabled opt-in, authenticated users can supply remoteimage URLs that are fetched server-side via requests.get with only Django's URLValidator check. There is no validation against...

CVE-2026-39362

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREEDOWNLOADFROMURL is enabled opt-in, authenticated users can supply remoteimage URLs that are fetched server-side via requests.get with only Django's URLValidator check. There is no validation against...

PT-2026-31437

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE DOWNLOAD FROM URL is enabled opt-in, authenticated users can supply remote image URLs that are fetched server-side via requests.get with only Django's URLValidator check. There is no validation again...

GHSA-CJ9F-H6R6-4CX2 Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

Summary A bug in Astro's image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. Details Astro provides an inferSize option that fetches remote images at render time to determine their dimensions. Remo...

CVE-2026-25870

DoraCMS version 3.1 and prior contains a server-side request forgery SSRF vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The...