CVE-2024-23336 Incomplete disallowed remote addresses list in MyBB

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list $config'disallowedremoteaddresses'...

Knowledge Base documentation & wiki plugin – BasePress < 2.16.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery

Description The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.16.1 via the themestylerender function. This makes it possible for authenticated attackers, with subscriber-level...

Absolutely Glamorous Custom Admin < 7.2.4 - Admin+ SSRF

Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal servic...

CVE-2024-33832

OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery SSRF via the component /index.php?c=api&method=getlinkinfo...

CVE-2024-33832

OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery SSRF via the component /index.php?c=api&method=getlinkinfo...

CVE-2024-2663

CVE-2024-2663 : ZD YouTube FLV Player plugin for WordPress is affected. All versions up to 1.2.6 are vulnerable to Server-Side Request Forgery via the $_GET['image'] parameter. This SSRF allows unauthenticated attackers to issue web requests from the vulnerable web application to arbitrary destin...

CVE-2024-0216

The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating...

CVE-2024-0216

The CVE-2024-0216 entry for Google Doc Embedder (WordPress) is a SSRF vulnerability in the gview shortcode present in WordPress plugin versions up to 2.6.4. Reported impact states that authenticated users with contributor permissions can cause the application to make outbound requests to arbitrar...

FV Flowplayer Video Player < 7.5.45.7212 - Authenticated (Subscriber+) Server-side Request Forgery

Description The FV Flowplayer Video Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.5.43.7212. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations...

WordPress ZD YouTube FLV Player Plugin <= 1.2.6 is vulnerable to Server Side Request Forgery (SSRF)

Software ZD YouTube FLV Player Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2663 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 49305c6b35a4 Credits Mike Required privile...

Embed Google Photos album < 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery

Description The Embed Google Photos album plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.0 via the Pavexembedgooglephotosalbum class. This makes it possible for authenticated attackers, with contributor-level access and above, to make w...

CVE-2024-33832

OneNav v0.9.35-20240318 is vulnerable to Server-Side Request Forgery (SSRF) via the url parameter in the get_link_info API (index.php?c=api&method=get_link_info). An attacker can force the server to make arbitrary requests, potentially accessing internal resources. The connected Nuclei template c...

CVE-2024-33449

An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url parameter...

CVE-2024-33590

Server-Side Request Forgery SSRF vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1...

CVE-2024-33590 WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1...

CVE-2024-33590

CVE-2024-33590 is a Server-Side Request Forgery (SSRF) in the Knowledge Base documentation & wiki plugin – BasePress (BasePress Docs) for WordPress, running any version up to 2.16.1. The vulnerability is documented in the CVE entry and mirrored in Red Hat and Wordfence references, which indicate ...

CVE-2024-33590 WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1...

Sandbox Escape Vulnerabilities in Judge0 Expose Systems to Complete Takeover

Multiple critical security flaws have been disclosed in the Judge0 open-source online code execution system that could be exploited to obtain code execution on the target system. The three flaws, all critical in nature, allow an "adversary with sufficient access to perform a sandbox escape and...

CVE-2024-33629

Server-Side Request Forgery SSRF vulnerability in Creative Motion Auto Featured Image Auto Post Thumbnail.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through 4.0.0...

CVE-2024-33634 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17...