CVE-2024-39713

CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Links: https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 Usage root@kitploit: pip install -r requirements.tx...

CVE-2026-64849.yaml

id: CVE-2026-64849 info: name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass author: DhiyaneshDk severity: critical description: | MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach interna...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

CVE-2026-92184

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

CVE-2026-64849

CVE-2026-64849 More root@kitploit: POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" root@kitploit: POST...

CVE-2026-88592

kkFileView versions 4.2.0 and above are vulnerable to a Server-Side Request Forgery (SSRF) in the /getCorsFile cross-origin file proxy endpoint. The root cause is a parameter mismatch : TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only re...

CVE-2026-88592

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92775: Server-Side Request Forgery (SSRF)

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

CVE-2025-56563

CVE-2025-56563 is a Server-Side Request Forgery (SSRF) vulnerability in sat_proxy.php of Zenith Satellite Tracker 1.0 . The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation , allowing an unauthenticated remote ...

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

EUVD-2025-210923

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

EUVD-2026-81259

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2021-26855-PoC

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. CVE-2021-26855 ssrf simple use of golang exercises Affected version root@kitploit: Exchange Server 2013 is less than CU23 Exchange Server 2016 is less than CU18 Exchange Server 201...

CVE-2026-92184

A server-side request forgery (SSRF) vulnerability exists in ag-ui-protocol ag-ui 0.3.0 , affecting the function urllib.request.urlopen in the file integrations/aws-strands/python/src/ag_ui_strands/utils.py within the Multimodal Content component. Manipulation of the argument Value enables the fl...

CVE-2026-92184 ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

CVE-2026-92184 ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

cve-2023-27163

Thank you to @beet1ehttps://github.com/b33t1e from Shanghai Jiao Tong University and @chenlibo147 , @houqinsheng, [email protected] from Shandong University. Please review https://notes.sjtu.edu.cn/s/MUUhEymt7 for indepth information about the SSRF vulnerability CVE-2023-27163. This code is...

Havoc-C2-SSRF-to-RCE

Havoc-C2-SSRF-to-RCE This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabilities in Havoc C2 Framework...