Server Side Request Forgery

automad is vulnerable to Server Side Request Forgery. The vulnerability is due to improper validation of the importUrl argument within FileController.php. This issue can be exploited by an attacker to internal perform a port scan against the local environment or abuse local services...

CVE-2023-5877

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkpimagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a...

Server side request forgery (ssrf)

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkpimagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a...

CVE-2023-5877 affiliate-toolkit < 3.4.3 - Unauthenticated SSRF

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkpimagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a...

PT-2024-14836 · WordPress · Affiliate-Toolkit

Name of the Vulnerable Software and Affected Versions: affiliate-toolkit WordPress plugin version 3.4.2 and earlier Description: The issue is related to a lack of authorization and authentication for requests to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint, allowing...

Miniflare vulnerable to Server-Side Request Forgery (SSRF)

Impact Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces as was the default in wrangler until 3.19.0, an attacker on the local network...

Exploit for Server-Side Request Forgery in Apache Ofbiz

CVE-2023-51467 - Apache OFBiz Authentication Bypass This flaw...

Exploit for Server-Side Request Forgery in Apache Ofbiz

CVE-2023-51467 Scanner 🕵️‍♂️ Description 📜 CVE-2023-51467...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1...

CVE-2023-51676

CVE-2023-51676 (Happy Addons for Elementor) : The connected documents confirm a Server-Side Request Forgery (SSRF) vulnerability in the Happy Addons for Elementor plugin, affecting the product from n/a through version 3.9.1.1. The entry is active and has been patched in a later release. The vulne...

CVE-2023-7078 Server-Side Request Forgery (SSRF) in Miniflare

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces as was the default in wrangler until 3.19.0, an attacker on the local network could...

Exploit for Server-Side Request Forgery in Apache Ofbiz

CVE-2023-51467 exp.py changed to command execution P...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

Proof Of Concept of SSRF on Request-Baskets CVE-2023-27163...

Apache OFBiz server-side request forgery vulnerability (CNVD-2024-01013)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. Apache OFBiz suffers from a server-side request forgery vulnerability that can be exploited by an attacker ...

Server side request forgery (ssrf)

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request SSRF vulnerability in podcastUtils.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this...

XWiki 11.10.1 < 14.10.15, 15.x < 15.5.1 SSRF Vulnerability (GHSA-7rfg-6273-f5wp)

Xwiki is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Exploit for Server-Side Request Forgery in Naviwebs Navigate_Cms

It is an exploit module targeting Apache HTTP Server. The targe...

Server side request forgery (ssrf)

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discordwebhook variable and pass...

Server side request forgery (ssrf)

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...

CVE-2023-50259 Blind SSRF in /home/testslack endpoint

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery SSRF. The testslack request handler in medusa/server/web/home/handler.py does not validate the user-controlled slackwebhook variable and passes i...