The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in insufficient testing of server-side requests. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in insufficient testing of server-side requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

CVE-2026-100705

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100705

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

EUVD-2026-87678

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

EUVD-2026-87671

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

EUVD-2026-87670

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...

EUVD-2026-87654

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

EUVD-2026-87696

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| ||v2 |/ Lazyrecon v2는 유효한 서브도메인을 찾고 해결한 다음 SSRF/LFI/SQLi 퍼징, 무차별 대입 및 포트 스캐닝을 수행하는 서브도메인 발견 도구입니다. 간단한 모듈식 아키텍처를 가지고 있으며 github 및 wayback machine과 함께 작업할 때 속도에 최적화되어 있습니다. Features 초고속 비동기 실행 CI/CD 준비...

CVE-2025-45955

CVE-2025-45955 DonWeb Ferozo におけるサーバーサイドリクエストフォージェリ CVE-2025-45955 説明 攻撃者は、Ferozo ホスティングプラットフォーム上に特別に細工された PHP ファイルをアップロードして実行することで、この脆弱性を悪用できます。このファイルにアクセスすると、内部サービス（127.0.0.1、169.254.169.254、サービスメッシュエンドポイントなど）、ローカルファイル（例：file:///etc/passwd）、および既知のクラウドメタデータエンドポイントを標的とする一連の SSRF...

Havoc-C2-SSRF-poc

CVE-2024-41570: Havoc-C2-SSRF-poc この脆弱性は、Demon エージェントの登録とチェックインを偽装して teamserver 上に TCP ソケットを開き、そこからデータを読み書きすることで悪用されます。これにより、攻撃者は teamserver のオリジン IP などを漏えいさせることができます。 完全な分析: https://blog.chebuya.com/posts/server-side-request-forgery-on-havoc-c2/...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

CVE-2022-29078

CVE-2022-29078 ejs 3.1.6 docker の脆弱性 セットアップ root@kitploit: git clone https://github.com/miko550/CVE-2022-29078.git cd CVE-2022-29078 docker build . -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs 使用方法 root@kitploit: http://127.0.0.1:49160/ エクスプロイト ブラウザ上 root@kitploit:...

CVE-2026-100577

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

EUVD-2026-87474

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

EUVD-2026-87475

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100555

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

EUVD-2026-87495

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...