EUVD-2026-69940

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

EUVD-2026-69938

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-84764

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...

CVE-2026-84759

CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Activity Log plugin by ArYo, affecting versions ≤ 2.13.1 . The flaw was discovered by Asim Alshaya and is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicati...

CVE-2021-31760

..| CVE-2021-31760 |.. 描述： 通过 Webmin 的进程运行功能，利用跨站请求伪造（CSRF）攻击获取远程命令执行（RCE） 测试版本： Webmin 1.973（GitHub 上 2021 年 3 月 7 日的最新版本） 攻击类型： 远程 影响： 远程命令执行 漏洞利用代码 POC： YouTube POC： https://youtu.be/D45FN8QrzDo 产品厂商： https://www.webmin.com 附加信息： “Webmin 是一种基于 Web 的系统管理工具，适用于类 Unix 服务器和服务，全球安装量超过...

WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by sicksec in WordPress Plugin LiteSpeed Cache versions = 7.9...

VMWare-vRealize-SSRF

VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 使用 python CVE-2021-21975.py...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable a falsificación de solicitud del lado del servidor Carga útil : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHER...

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by John Ryan Albon in WordPress Plugin Mang Board WP versions = 2.3.8...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2024-34958

CVE-2024-34957 idccms CSRF poc CVE-2024-34958 idccms CSRF poc...

halo-2.25.4-CVE-2026-67919

Ejecución Remota de Código RCE Autenticada mediante Instalación de Plugins con URI no Validado en Halo 2.25.4 1. Resumen de la Vulnerabilidad Se ha identificado una vulnerabilidad de seguridad crítica en la versión 2.25.4 de Halo. La aplicación proporciona un endpoint administrativo para instalar...

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery

Onair2 3.9.9.2 and KenthaRadio 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery. id: CVE-2021-24472 info...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

CVE-2026-81432

CVE-2026-81432 affects the JetStyleManager for Gutenberg WordPress plugin in versions before 1.3.9 . The root cause is a missing CSRF protection on certain AJAX actions, allowing an attacker to craft a request that, when executed by a logged-in user with the edit_posts capability (Contributor or ...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF 취약점 📌 개요 CVE-2026-44578 은는 자체 호스팅 Next.js 애플리케이션에 영향을 미치는 고심각도 서버 측 요청 위조SSRF 취약점입니다. 공격자는 조작된 WebSocket 업그레이드 요청 을 악용하여 서버가 내부 또는 외부 시스템에 아웃바운드 요청을 보내도록 강제할 수 있습니다. ⚠️ 영향 이 취약점으로 인해 공격자가 다음에 접근할 수 있습니다: 대상| 위험 ---|--- 🔐 내부 API| 무단 내부 액세스 ☁️ 클라우드 메타데이터 엔드포인트| 자격 증명...

CVE-2025-45250

CVE-2025-45250 建议描述 root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 参考报告：GHSA-pgpj-v85q-h5fm 该仓库包含一个 docker compose 配置，用于搭建一个 pyLoad 服务器和一个仅提供 csrf.html 的攻击者服务器。若要自行测试，只需运行 docker composer up（除 docker 外，你还需要安装 docker composer）。 然后，首先访问 localhost:8000（pyLoad 登录页面），使用用户 pyload 和密码 pyload 登录。接着，访问 localhost:8001/csrf.html，该页面会立即向 pyLoad API...