EUVD-2026-67794

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-54745

Kubeflow Pipelines prior to 2.17.0 is affected by an unauthenticated SSRF vulnerability in the frontend /_proxy/ route (proxy-middleware.ts). The _routePathWithReferer() function forwards an attacker-controlled HTTP/HTTPS origin to createProxyMiddleware without a host allowlist or filtering for l...

CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-5096

The Everest Forms WordPress plugin (versions

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Exploit da SSRF a LFI di Apache CXF MTOM XOP:Include ⚠️ DICHIARAZIONE DI NON RESPONSABILITÀ QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA EDUCATIVI E AUTORIZZATI Questo exploit proof-of-concept è fornito a scopo educativo per aiutare i professionisti della sicurezza a comprendere l...

CVE-2025-55182-exploit

⚠️ AVISO Esta ferramenta é destinada APENAS para testes de segurança autorizados e fins educacionais. Teste apenas sistemas que você possui ou para os quais tenha permissão explícita por escrito. O uso não autorizado é ilegal e antiético. Os desenvolvedores não assumem nenhuma responsabilidade por...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerabile a server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

VMWare-vRealize-SSRF

VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 VERWENDUNG python CVE-2021-21975.py...

CVE-2026-9491

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2025-45250

CVE-2025-45250 Descrizione suggerita root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie...

CVE-2026-82081

wallabag versions 2 through 2.6.14 are affected by a Server-Side Request Forgery (SSRF) vulnerability caused by a crafted title or content field being mishandled during PDF export . The CVSS 3.1 score is 6.4 (Medium) with a scope change, indicating that exploitation could affect a different secur...

CVE-2026-78498

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

poc_proxylogon

pocproxylogon PoC do Microsoft Exchange ProxyLogon CVE-2021-26855 Este script foi originalmente criado por celesian para explorar esta CVE. Depois, eu o atualizei para explorar um servidor Exchange vulnerável a SSRF, mas ele obtém uma shell explorando o recurso EWS, porque uma empresa cliente...

EUVD-2026-67301

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function sfetchpage/sfetchpattern of the file src/scraplingfetchmcp/fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgradi...

PT-2026-83226

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499 Dimension SSRF via FTP Server Test Connection

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2021-21349

CVE-2021-21349 XStream SSRF Anúncio Oficial do XStream CVE-2021-21349 Vulnerabilidade CVE-2021-21349: Uma Solicitação de Falsificação do Lado do Servidor Server-Side Forgery Request pode ser ativada durante o unmarshalling com o XStream para acessar fluxos de dados de uma URL arbitrária que...