Next.js Improper Middleware Redirect Handling Leads to SSRF

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next. In self-hosted applications, this could allow Server-Side Request Forgery SSRF if certain sensitive headers from the incoming request...

PT-2025-35322

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.32 and prior to 15.4.7 Description Next.js is a React framework for building full-stack web applications. When the next function was used without explicitly passing the request object in self-hosted applications,...

Next.js 代码问题漏洞

Next.js is a React framework open-sourced by Vercel. A code issue vulnerability exists in versions of Next.js prior to 14.2.32 and 15.4.7, which stems from improper use of the next function and could lead to server-side request forgery...

CVE-2025-31971

AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery SSRF attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information...

CVE-2025-53250 WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Chartbeat Chartbeat allows Server Side Request Forgery. This issue affects Chartbeat: from n/a through 2.0.7...

CVE-2025-53250

CVE-2025-53250 corresponds to a Server-Side Request Forgery in the WordPress Chartbeat Plugin (versions n/a–2.0.7). The CVSS 3.1 base metrics indicate a Network attack vector, Low attack complexity, Low privileges required, no user interaction, with Confidentiality and Integrity impacts both Low ...

CVE-2025-48364

CVE-2025-48364 is a Server-Side Request Forgery (SSRF) vulnerability impacting the WordPress rajce plugin (vEnCa-X) versions n/a through 0.4.2. According to the sources, the issue affects rajce up to 0.4.2 and has a CVSS v3.1 base score of 4.9 (Network, High attack complexity, Low privileges, No ...

CVE-2025-48364 WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through = 0.4.2...

HCL AIML Solutions for SXVersions 1 Total 安全漏洞

HCL AIML Solutions for SXVersions 1 Total is an extension for intelligent services and predictive capabilities from HCL India. A security vulnerability exists in HCL AIML Solutions for SXVersions 1 Total version 1.0, which stems from improper URL validation and could lead to server-side request...

WordPress plugin rajce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin Chartbeat 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Solace Extra versions = 1.3.2...

CVE-2025-58203

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

Linux Distros Unpatched Vulnerability : CVE-2017-1000190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SimpleXML latest version 2.7.1 is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. CVE-2017-1000190 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2023-36661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for exampl...

Linux Distros Unpatched Vulnerability : CVE-2021-22214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from...

The vulnerability in the web interface of Cisco Firepower Management Center’s software management interface allows a perpetrator to execute an SSRF attack.

The vulnerability of the web interface of the Cisco Firepower Management Center FMC software management system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

WordPress plugin Solace Extra 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...