WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Allmart versions = 1.0.0...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-5817

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-5817 Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-5817

The CVE-2025-5817 entry concerns the WordPress plugin Amazon Products to WooCommerce. It is a Server-Side Request Forgery (SSRF) via wcta2w_get_urls() affecting all versions up to 1.2.7. It allows unauthenticated attackers to forward web requests from the application to arbitrary locations, poten...

CVE-2025-5817 Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

HPESBNW04886 rev.1 - HPE Telco Service Orchestrator Software, Server-Side Request Forgery (SSRF) Vulnerability

Potential Security Impact: Remote: Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-27817 |...

WordPress Amazon Products to WooCommerce plugin <= 1.2.7 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ch4r0n in WordPress Plugin Amazon Products to WooCommerce versions = 1.2.7...

CVE-2025-34051

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051

CVE-2025-34051 describes a server-side request forgery in AVTECH DVR devices. The unauthenticated vulnerability targets /cgi-bin/nobody/Search.cgi?action=cgi_query and lets an attacker supply ip, port, and queryb64str to force the DVR to perform arbitrary HTTP requests, potentially leaking data o...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

CVE-2025-45872 affects zrlog v3.1.5 and is described as a Server-Side Request Forgery (SSRF) in the downloadUrl parameter. The base metrics indicate a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; 9.8) with high confidentiality, integrity, and availability implications. The conn...

PT-2025-27535 · Avtech · Avtech Dvr

Name of the Vulnerable Software and Affected Versions: AVTECH DVR devices affected versions not specified Description: A server-side request forgery issue exists in AVTECH DVR devices, exposing the "/cgi-bin/nobody/Search.cgi?action=cgi query" endpoint without authentication. An attacker can...

BIT-ELK-2025-25012 Kibana Open Redirect

URL redirection to an untrusted site 'Open Redirect' in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL...

Server Side Request Forgery (SSRF)

github.com/octo-sts/app is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation and sanitization of OpenID Connect token fields, allowing attackers to craft tokens that trigger internal network requests...

CVE-2025-52491

CVE-2025-52491 affects Akamai CloudTest prior to version 60 2025.06.09 (12989) and allows server-side request forgery (SSRF). The NVD entry lists CVSS 3.1 base score 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Connected sources confirm the affected release and remediation guidance; PT-2025-27471 r...