CVE-2026-62142

The Melapress WP 2FA plugin (wp-2fa) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions 4.1.0 and below . This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The documentation does not specify the exact component...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 Título do Exploit: Vehicle Service Management System - 'Múltiplas' Falsificação de Solicitação entre Sites CSRF Leva a Script entre Sites Armazenado XSS Autor do Exploit: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM Referências:...

CVE-2026-107449

A flaw was found in Heimdall. This vulnerability allows an unauthenticated remote attacker to cause information disclosure via server-side request forgery SSRF. The application fails to enforce IP address restrictions when sending outbound requests for enhanced application testing and live...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

PT-2026-108114

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff rtsp connect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...

GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

NPM: Next.js has Server-Side Request Forgery in Image Optimization

NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

CVE-2025-70522

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

CVE-2025-70517

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-Band-Verifizierer für GHSA-c4j6-fc7j-m34r / CVE-2026-44578 – Serverseitige Anfragenfälschung SSRF in Next.js über WebSocket-Upgrade-Anfragen. ⚠️ Nur für autorisierte Sicherheitstests. Sie sind dafür verantwortlich sicherzustellen, dass Sie die Erlaubnis haben, jedes...

CVE-2025-57310

CVE-2025-57310 Una vulnerabilità di Cross-Site Request Forgery CSRF in Salmen2/Simple-Faucet-Script v1.07 tramite una richiesta POST appositamente predisposta a admin.php?p=ads&c=1 che consente a un attaccante di eseguire codice arbitrario. CWE CWE-352: Cross-Site Request Forgery CSRF Punteggio...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...