CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF che porta a RCE Questo bug consente a un sito web remoto di creare e avviare un container Docker arbitrario sulle macchine che eseguono Che precedente alle versioni 7.3.0 e 7.4.1 quando un utente visita una pagina web. Vulnerability Questa è una vulnerabilità CSRF...

WebLogic-SSRF_CVE-2014-4210

WebLogic-SSRFCVE-2014-4210 Script di sfruttamento Weblogic SearchPublicRegistries SSRF CVE-2014-4210 basato su Python3 Utilizzo argomenti opzionali: -h, --help mostra questo messaggio di aiuto ed esci -u U URL del singolo target -uf UF Leggi URL da file -p P Scansiona solo le porte specificate -s...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. الوصف : استغلال هجوم تزوير الطلب عبر المواقع CSRF لإنشاء مستخدم متميز عبر ميزة إضافة المستخدمين في Webmin ثم الحصول على شل عكسي عبر ميزة العمليات الجارية في Webmin الإصدار المختبر : Webmin 1.973 أحدث إصدار على GitHub 07/03/2021 نوع الهجوم: عن بُعد التأثير : تنفي...

CVE-2019-11581

CVE-2019–11581 PoC...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-16600

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2022-28117

CVE-2022-28117 Navigate CMS = 2.9.4 - Server-Side Request Forgery Autenticato Descrizione Una Server-Side Request Forgery SSRF nella classe feedparser di Navigate CMS v2.9.4 consente a un attaccante remoto di forzare l'applicazione a effettuare richieste arbitrarie tramite l'iniezione di URL...

CVE-2021-21311

CVE-2021-21311 Descrizione SSRF Server-side Request Forgery in Adminer Strumento Open Source per la gestione di database dalla v4.0.0 v4.7.8 corretta in v4.7.9 Commit della patch Utilizzo root@kitploit: exploit.py -h -target TARGET -redirect REDIRECT -host HOST -port PORT options: -h, --help show...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-16600

CVE-2026-16600 affects the SmartAIPress WordPress plugin through 1.2.0 . The root cause is a missing capability check on the AJAX action smartaipress_openai_upload_and_set_featured_image, combined with the absence of URL validation before a server-side fetch. This allows any user with subscriber-...

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16947

CVE-2026-16947 affects the Total processing card payments for WooCommerce WordPress plugin (through version 7.3 ). The plugin fails to validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response. This allows unaut...

EUVD-2026-67951

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Creato da TheAlchimist root@kitploit: cve-2023-27163-ssrfbaskets.py esempio : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

CVE-2026-19294

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an improper authorization flaw (CWE-639). Deprecated build endpoints remain fully routed but lack the object-level ownership check present on the modern equivalent endpoint, allowing any authenticated user to enumerate and execute ano...

CVE-2026-18899

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to a path traversal (CWE-22) that allows an unauthenticated remote attacker to read arbitrary files. The root cause is in the public flow-build endpoint, which accepts an unvalidated files parameter forwarded directly to the storage backend; the...

CVE-2026-18891

IBM Langflow OSS versions 1.0.0 through 1.11.1 is affected by an improper authentication flaw (CWE-287) in the MCP project authentication function. When MCP Composer is enabled, the function omits the default auth_type=none value from the set of modes requiring an API key, causing unauthenticated...

List-CVE-2025-2026

CVE-2025-69412 - O KDE messagelib anterior à versão 25.11.90 ignora erros SSL para threatMatches:find na API Google Safe Browsing Lookup também conhecida como API de phishing, o que pode permitir ... 2. CVE-2025-69413 - No Gitea anterior à versão 1.25.2, /api/v1/user tem respostas diferentes...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...