CVE-2024-13907 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2024-13907

CVE-2024-13907 : The BoldGrid WordPress plugin “Total Upkeep” (Backup Plugin plus Restore & Migrate) is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.16.8 via the plugin’s download function. An attacker with at least Administrator+ privileges can cause the...

CVE-2024-13905

The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and...

CVE-2024-13905 OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery

The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and...

CVE-2024-13905

The CVE CVE-2024-13905 affects the WordPress OneStore Sites plugin up to version 0.1.1, with the vulnerability exploiting class-export.php to trigger unauthenticated Server-Side Request Forgery (SSRF). This enables an attacker from the web app to issue requests to arbitrary destinations and can b...

CVE-2024-13905 OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery

The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and...

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

PT-2025-9016 · Elestio · Elestio Memos

Name of the Vulnerable Software and Affected Versions: elestio memos version 0.23.0 Description: The issue is related to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. This vulnerability allows attackers to...

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

CVE-2025-22952

Elestio Memos (v0.23.0) is affected by CVE-2025-22952: a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs. The Nuclei template confirms the issue as applicable to MEMOS versions up to 0.24.0 and notes that unauthenticated attackers can exploit SSRF to access...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25827

CVE-2025-25827 describes a Server-Side Request Forgery (SSRF) in the sort.php component of Emlog Pro v2.5.4 that allows an attacker to scan local and internal ports by supplying a crafted URL. The CVSS base score is 6.8 (Medium) with Impact to confidentiality and Privilege level: none , indicatin...

CVE-2025-25785

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery SSRF via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25785

CVE-2025-25785 affects JizhiCMS v2.5.4 through a Server-Side Request Forgery (SSRF) in the c\PluginsController.php component. The vulnerability enables an attacker to initiate an intranet scan via a crafted request. The reported impact is high confidentiality and integrity risk (C/H, I/H) with no...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...