Lucene search
+L

125964 matches found

BDU FSTEC
BDU FSTEC
added 2026/08/23 11:43 p.m.28 views

The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.

The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...

7.7CVSS5.7AI score
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/23 7:16 p.m.4 views

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

SaveExploits0References5
Cvelist
Cvelist
added 2026/08/23 6:16 p.m.11 views

CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

SaveExploits0References4
EUVD
EUVD
added 2026/08/23 6:16 p.m.6 views

EUVD-2026-64662

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

5.6AI score
SaveExploits0References4
CVE
CVE
added 2026/08/23 3:45 a.m.13 views

CVE-2026-78061

CVE-2026-78061 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability is a server-side request forgery (SSRF) in the Email Sync component, specifically in the function buildImapConfig within lib/email-sync/imap-client.ts. An attacker can manipulate the host/port arguments to force the se...

6.5CVSS6.3AI score
SaveExploits0References7
EUVD
EUVD
added 2026/08/23 3:45 a.m.10 views

EUVD-2026-64626

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

6.5CVSS6.3AI score
SaveExploits0References7
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.33 views

Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)

Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter. id: CVE-2020-16248 info: name: Prometheus Blackbox Exporter - Server-Side...

5.8CVSS5.8AI score0.02698EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.69 views

Reprise License Manager 14.2 - Information Disclosure

Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostnames, system architecture and file/directory...

5.3CVSS5.8AI score0.09149EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.25 views

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

9.8CVSS8.8AI score0.29557EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.175 views

WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

7.2CVSS6.8AI score0.41762EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.96 views

Online Security Guards Hiring System - Cross-Site Scripting

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. id: CVE-2023-0527 info: name: Online Security Guards Hiring System - Cross-Site Scripting author:...

6.1CVSS4AI score0.06118EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.140 views

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

5.3CVSS5.5AI score0.02214EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.122 views

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

5.3CVSS6.8AI score0.00875EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.74 views

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

8.5CVSS7.9AI score0.7829EPSS
SaveExploits13References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.31 views

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

7.3CVSS5.4AI score0.01933EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

9.1CVSS8.4AI score0.20249EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.98 views

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

7.5CVSS9AI score0.51897EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.152 views

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

9.8CVSS7.4AI score0.72917EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.53 views

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

7.2CVSS7.9AI score0.05213EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.305 views

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

6.5CVSS7.6AI score0.40637EPSS
SaveExploits2References2
Rows per page
Query Builder