CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

CVE-2025-0188 SSRF in gaizhenbiao/chuanhuchatgpt

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

CVE-2025-0188 SSRF in gaizhenbiao/chuanhuchatgpt

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

CVE-2025-0188

CVE-2025-0188 concerns a Server-Side Request Forgery (SSRF) in the project gaizhenbiao/chuanhuchatgpt, version 20240914. The described flaw allows an attacker to craft a response link by saving content to a folder named after the SHA-1 hash of the target URL, which can enable direct access to the...

CVE-2024-7959

The Open WebUI SSRF issue is in open-webui/open-webui version 0.3.8, exposed via the /openai/models endpoint. The vulnerable component allows changing the OpenAI URL without validation, causing the server to issue requests to arbitrary destinations and return their output. Reported impact include...

CVE-2024-7959

...

CVE-2024-7959 SSRF in open-webui/open-webui

The /openai/models endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery SSRF. An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the...

CVE-2024-12068

CVE-2024-12068 affects haotian-liu/llava (Git commit c121f04). The vulnerability is a Server-Side Request Forgery (SSRF) that lets the server perform HTTP requests to arbitrary URLs, potentially exposing data only reachable from the server, such as AWS metadata credentials. A PoC/exploitation wor...

CVE-2024-12068 Server-Side Request Forgery in haotian-liu/llava

A Server-Side Request Forgery SSRF vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such...

CVE-2024-12068 Server-Side Request Forgery in haotian-liu/llava

A Server-Side Request Forgery SSRF vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such...

CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

CVE-2024-11449

CVE-2024-11449 stems from haotian-liu/llava v1.2.0 (LLaVA-1.6) with insufficient validation of the path parameter on the "/run/predict" endpoint, enabling Server-Side Request Forgery (SSRF). An attacker can access internal networks or AWS metadata by sending crafted requests, leading to unauthori...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function vulnerability

Authenticated Administrator+ Server-Side Request Forgery via validatefile Function vulnerability discovered by HayMiz in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.6.0...

LLaVA 代码问题漏洞

LLaVA is an application by the individual developer Haotian Liu. A code issue vulnerability exists in LLaVA version 1.2.0, which stems from insufficient validation of path parameters and could lead to a server-side request forgery attack...

PT-2025-12155 · Comfyui · Comfyui

Name of the Vulnerable Software and Affected Versions: comfyanonymous/comfyui version v0.2.4 Description: The issue is related to a non-blind Server-Side Request Forgery SSRF vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view...

CVE-2024-48590

Inflectra SpiraTeam 7.2.00 is affected by CVE-2024-48590 due to a Server-Side Request Forgery (SSRF) vulnerability in NewsReaderService. The underlying issue allows an attacker to perform SSRF, potentially escalating privileges and disclosing sensitive data. Evidence in connected sources confirms...

PT-2025-12145 · Unknown +1 · Langgenius/Dify +1

Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: The issue is a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API endpoint POST...