255 matches found
CVE-2022-21667
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...
CVE-2022-39365
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...
CVE-2024-56800
Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery SSRF vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address...
CVE-2024-6036
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the /queue/join? endpoint with "fnindex":66. This unrestricted server restart capability can severely disrupt service availability, cause data loss or...
CVE-2024-24759
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contai...
CVE-2024-35231
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...
LobeChat < 1.19.13 Server-Side Request Forgery
According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 1.19.13. It is, therefore, affected by multiples Server-Side Request Forgery : - A Server-Side Request Forgery through proxy address - A Server-Side Request Forgery...
CVE-2023-50733 A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices.
A Server-Side Request Forgery SSRF vulnerability has been identified in the Web Services feature of newer Lexmark devices...
Ubuntu 20.04 LTS / 22.04 LTS : Python vulnerability (USN-7218-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7218-1 advisory. It was discovered that Python incorrectly handled parsing bracketed hosts. A remote attacker could possibly use this issue to perform a Server-Side...
CVE-2024-57252
OtCMS =V7.46 is vulnerable to Server-Side Request Forgery SSRF in /admin/read.php, which can Read system files arbitrarily...
CVE-2024-57252
OTCMS
CVE-2024-52594
Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...
CVE-2025-0480
A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely...
PT-2025-3561 · Msfm · Msfm
Name of the Vulnerable Software and Affected Versions: MSFM versions prior to v2025.01.01 Description: The issue is related to a Server-Side Request Forgery SSRF in MSFM, which occurs via the /file/download component. This allows for unauthorized access to internal resources. Recommendations: For...
CVE-2024-57767
MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery SSRF via the component /file/download...
Gradio < 4.42.0 SSRF
The version of Gradio installed on the remote host is prior to 4.42.0. It is, therefore, affected by a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources...
Security Bulletin: Vulnerability in Axios affect BM Spectrum Control
Summary Axios is vulnerable to server-side request forgery, This vulnerability affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol...
CVE-2025-22215
VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...
LangChain < 0.0.27 SSRF
The version of LangChain installed on the remote host is prior to 0.0.27. It is, therefore, affected by a server-side request forgery SSRF vulnerability in the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. Note that Nessus...