62123 matches found
CVE-2026-65512
CVE-2026-65512 affects the WordPress WP Activity Log plugin (WordPress)
EUVD-2026-48107
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65488
The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...
EUVD-2026-48099
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65471
Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...
CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65466
CVE-2026-65466 concerns a Server Side Request Forgery (SSRF) in the WordPress JetBooking plugin <= 4.1.2 . The description specifies a custom role -driven SSRF vulnerability affecting JetBooking versions up to 4.1.2. The CVSSv3.1 metrics (source: Patchstack) indicate a network attack vector , ...
CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
EUVD-2026-48182
Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...
CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...
CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
EUVD-2026-47915
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
PT-2026-64185
Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72 Description A server-side request forgery SSRF issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content...
PT-2026-63600
Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder...
PT-2026-64133
SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrape page validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...
PT-2026-64132
Summary A Server-Side Request Forgery SSRF vulnerability in the SearxNG / search web search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxng url argument is passed directly to requests.get with no validation of...