EUVD-2026-87985

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.calltool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal...

EUVD-2026-87979

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2018-10933-POC

CVE-2018-10933-POC libSSH обход Уязвимость была найдена в серверной части машины состояний libssh до версий 0.7.6 и 0.8.4 Это простой POC Здесь в коде замените и соответствующим образом...

react2shell-CVE-2025-55182

공격 구성 요소에는 공격 코드가 포함되어 있습니다. 주석을 해제하고 버튼을 누르기만 하면 공격을 수행할 수 있습니다. 서버에서 자신만의 코드를 실행하려면exploit payload에서 prefix 키의 값을 변경하기만 하면 됩니다. AttackString 파일에서 예제를 확인하세요...

basketcraft

basketcraft это скрипт, который эксплуатирует уязвимость CVE-2023-27163, представляющую собой SSRF в версии request-baskets 1.2.1 SSRF в Request-Baskets CVE-2023–27163 CVE-2023–27163 представляет собой критическую уязвимость типа Server-Side Request Forgery SSRF, обнаруженную в Request-Baskets,...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Быстрый старт 1. Настройка и сборка make setup make build 2. Запуск сервиса make up 3. Веб-доступ open http://localhost:8080 Цель Получите доступ к внутреннему Admin-сервису порт 3003 и получите флаг! Ожидаемый флаг : CTFflagreadme Эксплуатация cd exploits...

CVE-2018-14716

CVE-2018-14716 PoC для CVE-2018-14716 Эксплойт: Craft CMS SEOmatic плагин 3.1.4 - Серверная инъекция шаблонов Дата: 2018-07-20 Ссылка на ПО: https://github.com/nystudio107/craft-seomatic Автор эксплойта: Sebastian Kriesten 0xB455 Контакт: https://twitter.com/0xB455 CVE: CVE-2018-14716 Категория:...

CVE-2026-64849-poc-lab

보안 연구소 — MLflow Webhooks에서 SSRF 익스플로잇 CVE-2026-64849 · MLflow 사용 제한: 연구소 자료로, 승인된 네트워크 및 환경에서만 사용하세요. 법적 고지를 참조하세요. 1. 요약 속성| 값 ---|--- 취약점| CVE-2026-64849 — 웹훅 리디렉션 우회를 통한 SSRF 영향을 받는 구성 요소| MLflow Tracking Server 3.15.0 랩 버전| MLflow 3.13.0수정되지 않음, pip install 사용 근본 원인| TOCTOU: URL 검증 후 302를 재검증...

cve-2025-55182-node

CVE-2025-55182 Инструмент эксплуатации RCE в Next.js Китайская документация | Анализ принципов уязвимости !CAUTION ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ - ПРОЧТИТЕ ПЕРЕД ИСПОЛЬЗОВАНИЕМ Этот инструмент предназначен ТОЛЬКО для: Исследователей безопасности, проводящих проверку уязвимостей Авторизованного...

CVE-2026-89000

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

CVE-2026-100858

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

CVE-2026-100850

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

CVE-2026-100858

The heym software, in versions prior to 0.0.109 , is vulnerable to a Server-Side Request Forgery (SSRF) in the Slack, Discord, and Crawler workflow nodes . The root cause is the use of an unguarded HTTP client that issues requests to URLs provided in user-created credentials (specifically webhook...

CVE-2026-100858 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

CVE-2026-100858 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

EUVD-2026-87823

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

EUVD-2026-87838

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...

CVE-2026-100848

AzuraCast versions before 0.23.8 (specifically the azuracast/azuracast Composer package) are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the software validates the "Remote Relay" URL only for syntax and scheme (http/https) via Utilitiesase\Urls::parseUserUrl, but fa...