CVE-2023-49799

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-49799

The CVE-2023-49799 entry concerns the nuxt-api-party module, where a regex-based absolute-URL check (^https?://) can be bypassed by absolute URLs with leading whitespace (e.g., a leading newline). This can allow requests to bypass the whitelist, enabling Server-Side Request Forgery (SSRF) and pot...

SpeedyCache < 1.1.3 - Authenticated (Subscriber+) Server-Side Request Forgery

Description The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.2 via the speedycachecreatetestcache function. This makes it possible for authenticated attackers, subscriber-level access and...

CommentLuv <= 4 - Unauthenticated SSRF

Description The plugin is vulnerable to Server-Side Request Forgery via the doclick function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal service...

CVE-2023-41804

Server-Side Request Forgery SSRF vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4...

CVE-2023-41804

Server-Side Request Forgery SSRF vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4...

CVE-2022-45362

CVE-2022-45362 affects the WordPress Paytm Payment Gateway plugin up to version 2.7.0. The Nuclei template documents a server-side request forgery (SSRF) vulnerability allowing an attacker to cause the site to make requests to arbitrary domains, potentially exposing data or enabling unauthorized ...

CVE-2023-41804 WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4...

CVE-2023-41804

The CVE-2023-41804 entry relates to a Server-Side Request Forgery (SSRF) in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates (Starter Templates) affecting versions up to 3.2.4. Connected sources corroborate a likely SSRF vulnerability in the WordPress Starter T...

CVE-2023-46641 WordPress 12 Step Meeting List Plugin <= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24...

CVE-2023-46641

CVE-2023-46641: The WordPress plugin 12 Step Meeting List is vulnerable to Server-Side Request Forgery (SSRF) in versions

CVE-2023-49746 WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2...

CVE-2023-49746

CVE-2023-49746 affects the WordPress SpeedyCache Plugin up to version 1.1.2, with a Server-Side Request Forgery (SSRF) vulnerability in SpeedyCache – Cache, Optimization, Performance. The Red Hat and OpenVAS entries corroborate SSRF in this plugin, and Patchstack lists 1.1.3 as the fix. The root ...

CVE-2023-49746 WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2...

@angular-devkit/build-angular (17.1.0-next.0), @beetpx/beetpx (>=0.22.0, <=0.36.0) +17 more potentially affected by CVE-2023-49293 via vite (>=5.0.0, <=5.0.4)

vite NPM version =5.0.0, =0.22.0, =1.0.0-dev.74fcb60, =1.0.274, =0.0.1, =11.12.0-beta.0, =7.0.0, =0.1.38, =2.0.0-alpha.35, =0.12.0, =1.1.0, =2.0.9, =0.0.7, =1.1.0-develop.0, =1.1.0 and more Source cves: CVE-2023-49293 Source advisory: OSV:GHSA-92R3-M2MG-PJ97...

CVE-2023-46736

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

CVE-2023-46736

CVE-2023-46736 affects EspoCRM, with a Server-Side Request Forgery (SSRF) vulnerability in the image URL upload flow via the path “/Attachment/fromImageUrl”. The flaw allows an attacker with access to that endpoint to specify an internal URL, bypass content-type checks via redirects, and potentia...

CVE-2023-46736 Server-Side Request Forgery in espocrm

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

GHSA-GQJ2-324P-VX73 Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...