VulnCheck KEV: CVE-2021-39935

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket tagging endpoint. External entities referenced in an AccessControlPolicy XML document are resolved and retrieved. This allows attackers to perform server-side request forgery SSRF attack...

AutoGPT 代码问题漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to enable everyone to use and build accessible AI. A code issue vulnerability exists in versions prior to AutoGPT autogpt-platform-beta-v0.4.2, which stems from a Send Web Request component that could lead to server-side request forgery...

How to Create a Scan for Server-Side Request Forgery

This whitepaper covers how to create a scan in Perl to identify server-side request forgery in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SSRF problems at the cod...

PT-2025-10613

Name of the Vulnerable Software and Affected Versions autogpt-platform versions prior to autogpt-platform-beta-v0.4.2 Description The issue is related to a server-side request forgery SSRF vulnerability inside the Send Web Request component. The root cause is that IPV6 addresses are not restricte...

LocalS3 代码问题漏洞

LocalS3 is a Netty-based implementation of the Amazon S3 service by Luo's personal developer. A code issue vulnerability exists in LocalS3 versions prior to 1.21, which stems from the presence of an XML external entity injection vulnerability that could lead to a server-side request forgery attac...

Founder Electronics Enjoys All-Media Acquisition and Editing System 代码问题漏洞

Founder Electronics Enjoys All-Media Acquisition and Editing System is an all-media acquisition and editing system from Founder Electronics, a Chinese company. A code issue vulnerability exists in Founder Electronics Enjoys All-Media Acquisition and Editing System version 3.0, which stems from an...

CVE-2024-13924

The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'httprequesthostisexternal' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

WordPress plugin Starter Templates by FancyWP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2024-53696

A server-side request forgery SSRF vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center...

GHSA-JR5F-V2JV-69X6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

Summary A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF Server-Side Request Forgery. Reference: axios/axios6463 A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if...

QNAP Systems QTS、QNAP Systems QuTS hero和QNAP Systems QuLog Center 代码问题漏洞

QNAP Systems QuLog Center and others are products of QNAP Systems, Inc.QNAP Systems QuLog Center is a report field that records events reported by the system.QNAP Systems QTS is an entry-level operating system.QNAP Systems QuTS hero is an operating system. Systems QuTS hero is an operating system...

WordPress plugin Platform.ly for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists i...

CVE-2025-27652

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015...

CVE-2025-27655

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009...

Vasion Print 代码问题漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print versions prior to 22.0.862 and Application 20.0.2014 that stems from a server-side request forgery in the Elatec component...

Vasion Print 代码问题漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print versions prior to 22.0.862 and Application 20.0.2014 that stems from a server-side request forgery in the CPA v1 component...

Vasion Print 代码问题漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print that stems from a server-side request forgery in the rfIDEAS component...

CVE-2025-1848

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /importdatacheck. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2025-1849

A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /importdatatodb. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been...