Lucene search
+L

60 matches found

Kitploit
Kitploit
added 2026/08/27 8:56 a.m.1 views

CVE-2026-34160

CVE-2026-34160 — Chamilo LMS 中通过 PENS 插件(pens.php)实现未认证 SSRF 严重性 :高(CVSS 7.5) CWE :CWE-918(服务端请求伪造) 受影响版本 :chamilo/chamilo-lms 2.x(提交 af6b7002 及更早版本) 安全公告 :GHSA-g2xj-4cch-j276 NVD :https://nvd.nist.gov/vuln/detail/CVE-2026-34160 摘要 PENS(包交换通知服务)插件端点 public/plugin/Pens/pens.php 无需认证即可访问,并接受用户控制的 U...

8.6CVSS0.00344EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/27 8:56 a.m.1 views

CVE-2026-33715

CVE-2026-33715 — 通过 install.ajax.php 在 Chamilo LMS 中实现未认证 SSRF 与开放邮件中继 严重性 :高(CVSS 7.5) CWE :CWE-918(SSRF)+ CWE-306(缺少身份验证) 受影响版本 :chamilo/chamilo-lms 2.0(提交 0195b29 及更早版本) 安全公告 :GHSA-mxc9-9335-45mc NVD :https://nvd.nist.gov/vuln/detail/CVE-2026-33715 摘要 Chamilo LMS 2.0 中的 install.ajax.php...

7.2CVSS0.00208EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/08/27 6:08 a.m.2 views

fubucker

Fubucker | CVE-2022-1386 - Fusion Builder 自动批量检查CVE-2022-1386漏洞的工具 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 安装 JQ Linux : 命令 apt-get install jq -y Windows : 对于WSL,只需像Linux一样安装;对于GitBash,你可以执行以下命令 命令 curl -L -o C:/Program...

9.8CVSS8.5AI score0.72076EPSS
SaveExploits6References3
Kitploit
Kitploit
added 2026/08/27 4:36 a.m.3 views

CVE-2022-1386

CVE-2022-1386 - Fusion Builder 3.6.2 - SSRF no autenticado Descripción Fusion Builder es un plugin de WordPress que permite a los usuarios crear y editar páginas mediante una interfaz de arrastrar y soltar. Es vulnerable a un SSRF no autenticado que permite a un atacante leer cualquier archivo de...

9.8CVSS8.6AI score0.72076EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/26 1:14 a.m.2 views

CVE-2023-22047

Descrizione: CVE-2023-22047 è una lettura di file non autenticata su Oracle PeopleSoft. Tuttavia, uno sfruttamento avanzato da parte di un attaccante può consentire di usare questa vulnerabilità per eseguire codice in remoto Remote Code Execution. Nell'applicazione PeopleSoft, il file "Portal.war...

7.5CVSS8AI score0.7698EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/25 8:24 a.m.2 views

FC3er

FC3er | CVE-2022-0591 - Formcraft3 Ferramenta Automática em Massa para verificar vulnerabilidade no CVE-2022-0591 - Formcraft3 install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...

9.1CVSS8.5AI score0.20249EPSS
SaveExploits2
Vulnrichment
Vulnrichment
added 2026/08/17 3:54 p.m.6 views

CVE-2026-75053

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint...

5.4CVSS5.2AI score0.00182EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/11 4:30 p.m.9 views

EUVD-2026-56534

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

5.3CVSS5.5AI score0.00246EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/07 9:45 a.m.36 views

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

6.3CVSS0.0028EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/07/31 9:51 p.m.10 views

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

3.7CVSS5.5AI score0.00226EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/07/30 7:23 a.m.50 views

CVE-2026-18353

PIA’s POST /v1/upload/sbom validates a Bearer JWT by checking the unverified iss against an issuer allowlist using urlparse, then performs OIDC discovery with requests. A backslash in the authority (e.g., https://[email protected]/) is parsed into different hostnames, enabling an attac...

8.8CVSS6AI score0.00239EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 7:23 a.m.9 views

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

8.8CVSS5.5AI score
SaveExploits0References4
EUVD
EUVD
added 2026/07/28 5:53 p.m.11 views

EUVD-2026-49934

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...

8.6CVSS5.9AI score0.00379EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/13 3:02 p.m.13 views

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

8.6CVSS6.1AI score0.00454EPSS
SaveExploits0References7
GitLab Advisory Database
GitLab Advisory Database
added 2026/07/06 12:00 a.m.19 views

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

The Dragonfly scheduler's v1 gRPC service contains an unauthenticated Server-Side Request Forgery SSRF. When a peer reports a successful download of a TINY task, the scheduler calls Peer.DownloadTinyFile and issues an HTTP GET to a host and port taken verbatim from the attacker-controlled...

6.1AI score
SaveExploits0References12Affected Software1
Vulnrichment
Vulnrichment
added 2026/06/04 2:33 p.m.11 views

CVE-2026-43986 Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/ route that resolves attacker-controlled entries from imagehashlookup and replays them through the same server-side image fetch logic used by authenticated image proxying...

9.9CVSS5.9AI score0.00262EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/05/14 9:02 p.m.13 views

CVE-2026-44430 MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification POST /v0/auth/http, POST /v0.1/auth/http uses safeDialContext internal/api/handlers/v0/auth/http.go:67-110 to refuse dialling...

6.3CVSS5.9AI score0.00285EPSS
SaveExploits1References1
Github Security Blog
Github Security Blog
added 2026/05/05 6:21 p.m.19 views

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

9.9CVSS6AI score0.00272EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/04/10 8:34 p.m.6 views

CVE-2026-40242

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation...

7.2CVSS5.8AI score0.00621EPSS
SaveExploits1References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/04/10 4:39 p.m.6 views

CVE-2026-40100 FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default

FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress only blocks private IPs when CHECKINTERNALIP=true, which is not the default. This allows...

5.3CVSS5.9AI score0.00253EPSS
SaveExploits0References1
Rows per page
Query Builder