CVE-2024-48944

Server-Side Request Forgery SSRF vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1 The attacker has got admin access to a kylin...

CVE-2024-48944 Apache Kylin: SSRF vulnerability in the diagnosis api

Server-Side Request Forgery SSRF vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1 The attacker has got admin access to a kylin...

CVE-2024-48944

Apache Kylin is affected by a Server-Side Request Forgery (SSRF) in the /kylin/api/xxx/diag endpoint. The issue requires two preconditions: the attacker has admin access to a Kylin server and a second internal host exposes the /kylin/api/xxx/diag API, allowing forging requests to internal service...

CVE-2025-22672

Server-Side Request Forgery SSRF vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through = 1.1.2...

CVE-2025-22672 WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through = 1.1.2...

CVE-2025-22672 WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through = 1.1.2...

CVE-2025-22672

CVE-2025-22672 is a Server-Side Request Forgery (SSRF) vulnerability affecting WordPress plugin “Video & Photo Gallery for Ultimate Member” (versions up to and including 1.1.2). The issue, confirmed in multiple sources, is due to SSRF in the plugin and is listed as affecting versions from n/a thr...

CVE-2025-2109

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

CVE-2025-30914

Server-Side Request Forgery SSRF vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through = 3.9.2...

CVE-2025-30914

CVE-2025-30914 describes a Server-Side Request Forgery (SSRF) in MetForm (MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor) affecting versions up to 3.9.2. The vulnerability is categorized as SSRF with a CVSS v3.1 base score of 4.4 (Medium). The connected data confirms th...

CVE-2025-30914 WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through = 3.9.2...

CVE-2024-10206

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B APROL 4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs...

CVE-2024-10207

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B APROL 4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs...

CVE-2025-2835

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched...

CVE-2025-2835 zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched...

CVE-2025-2835

The CVE-2025-2835 entry concerns zhangyd-c OneBlog up to version 2.3.9. The vulnerable item is the autoLink function in com/zyd/blog/controller/RestApiController.java, where manipulation can trigger server-side request forgery (SSRF). The issue allows remote exploitation, and public disclosures e...

CVE-2025-2835 zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched...

SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)

SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...

Amazon Linux 2 : batik (ALAS-2025-2801)

The version of batik installed on the remote host is prior to 1.8-0.12.svn1230816. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2801 advisory. Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issu...

WordPress plugin Video & Photo Gallery for Ultimate Member 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...