CVE-2025-28093

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...

CVE-2025-28096

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery SSRF in custom headers...

PT-2025-13587 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2025.1000.4047 Description: The issue is related to Server-Side Request Forgery SSRF in the Collection Custom Interface feature. This allows an attacker to trick the server into making unintended requests. Recommendations: Fo...

CVE-2025-28091

maccms10 v2025.1000.4047 has a Server-Side Request Forgery SSRF vulnerability via Add Article...

CVE-2025-28096

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery SSRF in custom headers...

CVE-2025-28092

CVE-2025-28092 affects ShopXO v6.4.0 with a Server-Side Request Forgery (SSRF) via the image upload function. The vulnerability arises from insufficient validation of user-supplied URLs in image upload, enabling the server to initiate unintended requests. Metrics indicate CVSS v3.1: AV:N/AC:L/PR:...

PT-2025-13589 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO version 6.4.0 Description: The issue is related to Server-Side Request Forgery SSRF in the Email Settings. This means an attacker could potentially forge requests from the server, leading to unauthorized access to internal systems or...

CVE-2025-28091

maccms10 v2025.1000.4047 has a Server-Side Request Forgery SSRF vulnerability via Add Article...

CVE-2025-28096

CVE-2025-28096 affects OneNav 1.1.0. The vulnerability is Server-Side Request Forgery (SSRF) in custom headers. CVSSv3.1 base score 5.4 (MEDIUM); attack vector NETWORK; privileges required LOW; user interaction REQUIRED; impact is Confidentiality/Integrity LOW, Availability NONE. Root cause and e...

CVE-2025-28093

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...

CVE-2025-28093

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...

CVE-2025-28090

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery SSRF in the Collection Custom Interface feature...

PT-2025-13522 · W3Css · W3Css Validator

Name of the Vulnerable Software and Affected Versions: W3CSS Validator versions before cssval-20250226 Description: The issue is related to an XXE XML External Entity attack in the W3CSS Validator, which allows an attacker to use specially-crafted XML objects to coerce server-side request forgery...

CVE-2025-28090

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery SSRF in the Collection Custom Interface feature...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

CVE-2025-28089

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery SSRF via the Scheduled Task function...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

GHSA-3V67-545X-FFC3 Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint

Server-Side Request Forgery SSRF vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1 The attacker has got admin access to a kylin...

Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint

Server-Side Request Forgery SSRF vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1 The attacker has got admin access to a kylin...