CVE-2025-54249 Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls...

CVE-2025-49430 WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video Player: from n/a through = 10.1...

CVE-2025-49430

CVE-2025-49430 concerns the FWDesign Ultimate Video Player plugin for WordPress (versions through 10.1). A Server-Side Request Forgery (SSRF) vulnerability exists in the plugin, enabling an attacker to induce the server to make arbitrary requests. The issue is documented across multiple sources (...

CVE-2025-43763

A server-side request forgery SSRF vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw...

CVE-2025-44594

halo v2.20.17 and before is vulnerable to server-side request forgery SSRF in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url...

Ivanti多款产品 代码问题漏洞

Ivanti Connect Secure ICS and others are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti ZTA Gateway is a component in a network access software. A code issue...

PT-2025-36946

Name of the Vulnerable Software and Affected Versions: halo versions prior to 2.20.17 Description: The software is vulnerable to a server-side request forgery SSRF issue. The vulnerability exists in the /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url API endpoint...

PT-2025-36798

Name of the Vulnerable Software and Affected Versions: Rhys Wynne WP eBay Product Feeds versions through 3.4.8 Description: A Server-Side Request Forgery SSRF vulnerability exists in Rhys Wynne WP eBay Product Feeds, allowing Server Side Request Forgery. Recommendations: Update Rhys Wynne WP eBay...

@angular-devkit/build-angular (>=20.2.0-next.3, <=21.0.0-next.2), @angular/build (>=20.2.0-next.3, <=21.0.0-next.2) +30 more potentially affected by CVE-2025-58752 via vite (>=7.1.0, <=7.1.4)

vite NPM version =7.1.0, =20.2.0-next.3, =20.2.0-next.3, =2.1.2-alpha.0, =2.14.0, =30.0.0, =16.0.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =2.19.8, =2.19.8, =14.314.0, =14.314.0, =9.6.3, =0.0.0-snapshot-0360a7c2f707db55df213993503b56c6a1d96d0e, =0.4.0-dev.8 and more Source cves: CVE-2025-58752 Sourc...

CVE-2025-10096 SimStudioAI sim route.ts server-side request forgery

A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing manipulation of the argument filePath can lead to server-side request forgery. The attack can be executed remotely. The exploit has been...

CVE-2025-8085 Ditty < 3.1.58 - Unauthenticated SSRF

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

Awesome-Bugbounty-Writeups

This is a curated list of bug bounty writeups, specifically focusing on various types of web application vulnerabilities. The repository is organized by vulnerability type, with sections for Cross-Site Scripting XSS, Cross-Site Request Forgery CSRF, Clickjacking, Local File Inclusion LFI, Subdoma...

CVE-2025-9821

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal...

PT-2025-36168

Name of the Vulnerable Software and Affected Versions: aitool Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions n/a through 2.2.6 Description: A Server-Side Request Forgery SSRF vulnerability exists in aitool Ai Auto Tool Content Writing Assistant Gemini Writer,...

WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Exit Intent Popup versions = 1.0.1...

CVE-2025-58615

Server-Side Request Forgery SSRF vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through = 1.10.0...

CVE-2025-58615

CVE-2025-58615 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin WP Bannerize Pro. Public records in connected sources indicate affected versions are from n/a through 1.10.0. The vulnerability stems from improper handling of server-side requests, enabling an attacker t...

CVE-2025-9821 SSRF via webhook function

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal...

PT-2025-35749

Name of the Vulnerable Software and Affected Versions: WP Bannerize Pro versions n/a through 1.10.0 Description: A Server-Side Request Forgery SSRF vulnerability exists in WP Bannerize Pro. This issue allows Server Side Request Forgery. Recommendations: Update WP Bannerize Pro to a version later...

Linux Distros Unpatched Vulnerability : CVE-2022-35651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remot...