PoC Archive PoC Archive

tag

Cwe-918

Critical (per Ciscos own Security Impact Rating, despite a High numeric CVSS)
Cisco Unified Communications Manager WebDialer SSRF → Arbitrary File Write → Root (CVE-2026-20230)
CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW)· Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service patched
Critical
SonicWall SMA1000 WorkPlace SSRF → Internal Erlang RPC Remote Code Execution (CVE-2026-15409)
CVE-2026-15409 (SNWLID-2026-0008)· SonicWall SMA1000 Appliance — WorkPlace interface (websocket proxy service) unpatched
Critical
ThingsBoard IoT Platform SSRF via SVG Image Upload (CVE-2025-34282)
CVE-2025-34282· ThingsBoard IoT Platform (Image Upload Gallery / Widget Library) patched
Medium
WordPress User Language Switch Plugin SSRF — CVE-2026-0745
CVE-2026-0745 (GHSA-m38c-5p3m-p7gm)· WordPress "User Language Switch" plugin unpatched
High
Unauthenticated SSRF in Ech0 via /api/website/title (CVE-2026-35037)
CVE-2026-35037· lin-snow/Ech0 unpatched
Critical
Plunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096
CVE-2026-32096· Plunk (useplunk/plunk) email/webhook API unpatched
High
pdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)
CVE-2026-26801· pdfmake (Node.js PDF generation library), src/URLResolver.js patched
High
Kan SSRF via Attachment Download Endpoint — CVE-2026-32255
CVE-2026-32255 (GHSA-qrx8-9hc6-jvqg)· Kan (kanbn/kan) open-source project management tool patched
Medium
EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534
CVE-2026-33534· EspoCRM 9.3.3 patched
High
Chamilo LMS Unauthenticated install.ajax.php SSRF + Open Mail Relay — CVE-2026-33715
CVE-2026-33715 / GHSA-mxc9-9335-45mc· Chamilo LMS 2.0 unpatched
High
@haxtheweb/open-apis Credential Exposure via SSRF in cacheAddress Endpoint (CVE-2026-46391)
CVE-2026-46391 (GHSA-4fg7-f244-3j49)· @haxtheweb/open-apis (HAXcms/HAX ecosystem web service APIs) unpatched