CVE-2024-13741

CVE-2024-13741 affects ProfileGrid – User Profiles, Groups and Communities (WordPress). The vulnerability is an authenticated SSRF via the plugin’s pm_upload_image function, exploitable by users with Subscriber-level access and above. The issue enables the attacker to issue web requests from the ...

CVE-2024-13741 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pmuploadimage function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2024-13741 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pmuploadimage function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2025-20075

Server-side request forgery SSRF vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests could potentially lead to rebooting the services...

IBM Aspera Shares Server-Side Request Forgery Vulnerability

IBM Aspera Shares is a Web application from International Business Machines IBM. IBM Aspera Shares suffers from a server-side request forgery vulnerability that stems from the server not implementing an adequate authentication mechanism to confirm the origin of a request, which could be exploited...

CVE-2025-20075

Server-side request forgery SSRF vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests could potentially lead to rebooting the services...

CVE-2025-20075

Server-side request forgery SSRF vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests could potentially lead to rebooting the services...

CVE-2025-20075

CVE-2025-20075 describes a Server-Side Request Forgery (SSRF) in FileMegane by JIP InfoBridge. Affected versions are above 3.0.0.0 and below 3.4.0.0; the issue allows executing arbitrary backend Web API requests, with potential for rebooting services. Root cause is SSRF in FileMegane’s handling o...

CVE-2024-13879

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2024-13879 Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2024-13879 Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2024-13879

CVE-2024-13879 – WordPress Stream plugin : The vulnerability is a Server-Side Request Forgery (SSRF) in Stream versions up to 4.0.2, caused by insufficient validation of the webhook feature. Exploitation requires authenticated access with administrator-level privileges or higher, allowing an atta...

CVE-2024-13834

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2025-25297

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a cust...

CVE-2024-13834

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2024-13834

CVE-2024-13834 refers to a Server-Side Request Forgery in the WordPress plugin Responsive Plus (starter templates/advanced features/customizer) up to version 3.1.4, exploitable by an authenticated user with contributor+ rights via the remote_request function. The vulnerability allows web requests...

CVE-2024-13834 Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2024-13834 Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a cust...

CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a cust...