CVE-2026-62201-OpenClaw-SSRF

CVE-2026-62201 — OpenClaw 沙箱 Exec-Server 网络策略绕过（SSRF） 严重性： 高 · CVSS： 7.7（CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N）· CWE-918（服务端请求伪造） 漏洞概览 字段| 值 ---|--- 安全公告| GHSA-mgvr-6gvw-3rgr NVD| CVE-2026-62201 产品| OpenClaw（npm 包 openclaw）— 沙箱 exec-server 组件 受影响版本| openclaw 2026.6.6 已修复版本| 2026.6.6 及更高版本...

CVE-2026-76559

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-12944

CVE-2026-12944 Langflow 1.10.0 urllib SSRF Langflow OSS ≤ 1.10.0 — 通过 urllib.request / socket 实现自定义组件代码执行。组件扫描器的拒绝列表遗漏了这些标准库模块。IBM 已在 1.10.1 中修复。 IBM 将其评为 PR:L 。执行汇聚点是 POST /api/v1/customcomponent，该调用需要会话 cookie / bearer token。本 PoC 获取方式如下： 1. --test 不进行身份验证。 它仅执行 GET /api/v1/version（外加一次连通性 GET...

CVE-2026-76559

CVE-2026-76559 is a Server-Side Request Forgery (SSRF) in the WP Import Export Lite WordPress plugin, affecting versions before 3.9.33 . The root cause is improper URL validation during the import process, which allows users with the import capability (held by administrators by default ) to make ...

EUVD-2026-80183

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

WordPress WP Import Export Lite plugin < 3.9.33 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Yassin Mohamed in WordPress Plugin WP Import Export Lite versions 3.9.33...

apache-vulnerability-testing

Apache HTTP Server 脆弱性テストツール このリポジトリは、Apache HTTP Server のさまざまな脆弱性（ファイル名混乱攻撃、SSRF、サービス拒否、および最近のCVEに関連するその他の脆弱性）をテストするための Proof of Concept PoC を提供します。このツールは、サーバーが特定の種類の攻撃に対して脆弱かどうかを評価するために、細工されたHTTPリクエストを送信します。 特徴 複数の脆弱性をテストします。以下を含みます： CVE-2024-38472 : Windows上のApache HTTP ServerにおけるUNC SSRF...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

CVE-2025-63571

Description During analysis of the AI ​​system ChatGPT GPT-5, a Server-Side Request Forgery SSRF vulnerability was discovered. This issue occurs because the application automatically fetches and executes external URLs submitted by users e.g., webhooks without any validation or sanitization. By...

CVE-2023-49471

CVE-2023-49471 Vulnerability Type Blind SSRF Affected Product and Version Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0copyright" ------------------------...

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065 CTT-enhanced version of the Microsoft Exchange Server SSRF to RCE exploit ProxyShell/ProxyLogon, another CVSS 10.0 critical vulnerability that affected hundreds of thousands of organizations...

CVE-2025-4123-Exploit-Tool-Grafana-

CVE-2025-4123 - Grafana Path Traversal Exploit Developed by mitsec This is a proof-of-concept PoC exploit tool for CVE-2025-4123 , a critical path traversal vulnerability in Grafana's /public endpoint. The exploit allows for: ✅ Server-Side Request Forgery SSRF ✅ Local File Inclusion LFI ✅ Open...

CVE-2026-67620-poc

CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...

learnjavabug

Este proyecto es solo para investigación de seguridad. Se prohíbe usar este proyecto para lanzar ataques ilegales. El usuario es responsable de las consecuencias. Este es un proyecto personal para reproducir y publicar algunas vulnerabilidades interesantes o de gran impacto. No tiene mucho...

CVE-2026-92215

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-73315

CVE-2026-73315: SSRF through PayPal certificate URL XenForo before 2.3.13 fetches the certificate URL supplied by a PayPal REST webhook without restricting its destination. What happens The callback handler passes PAYPAL-CERT-URL to XenForo's trusted HTTP reader. It does not require a PayPal...

CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-92215

CVE-2026-92215 affects a2ui-project a2ui versions up to 0.10.7 . The vulnerability is a Server-Side Request Forgery (SSRF) in the FileResolver component, specifically in the httpx.get function within the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. An unaut...

cve-2024-56800-poc

cve-2024-56800 POC Reference https://nvd.nist.gov/vuln/detail/CVE-2024-56800 https://github.com/firecrawl/firecrawl/commit/4d1f92f4c8c36403022428285a03621fd90d62ec https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734 Vulnerability Firecrawl is a web scraper that allows...