CVE-2026-92931

The @progress/sitefinity-nextjs-sdk npm package (versions 15.1.8326 through 15.4.8637 ) is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918). This flaw may allow a remote attacker to force the server to make requests to an attacker-controlled host , which could lead to the exposure of ...

CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

CVE-2026-105290

The software feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the getCurlData endpoint, specifically involving an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php. An attacker can remotely launch t...

CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Unauthenticated Server-Side Request Forgery Description The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This...

security-research

Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 46 CVEs across 15 projects , 2023 to 2026. Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and...

CVE-2026-104407

Cross-Site Request Forgery CSRF vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9...

CVE-2026-20230

CVE-2026-20230 - Cisco Unified CM ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone https://github.com/HORKimhab/CVE-2025-46822 cd...

CVE-2026-105263

Shaarli versions up to 0.16.3 are vulnerable to a server-side request forgery (SSRF) flaw in the Admin Metadata Endpoint . The root cause is located in the MetadataController function within the file application/front/controller/admin/MetadataController.php, where a manipulation of the url argume...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-104407 WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9...

EUVD-2026-92306

Cross-Site Request Forgery CSRF vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9...

CVE-2026-104407

The PowerPress Podcasting plugin for WordPress (versions up to and including 11.17.9 ) is vulnerable to a Cross-Site Request Forgery (CSRF) (CWE-352). This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue has a HIGH base severity (CVSS...

CVE-2020-23592

CVE-2020-23592 OPTILINK E-PON "N.º DE MODELO: OP-XT71000N" con "VERSIÓN DE HARDWARE: V2.2"; y "VERSIÓN DE FIRMWARE: OPV3.3.1-191028" Se encontró una vulnerabilidad en el "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" que permite a un atacante remoto no autentica...

Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 Description The following vulnerabilities were identified in version 3.0.6 of the Leantime goals focused project management system. CVE-2024-27474 A cross-site request forgery CSRF vulnerability which, when triggered, would create and...

CVE-2026-105238 ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the...