tag
Ssrf
Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)
CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…
Apache Polaris — Cross-Tenant Credential Vending Before Location Validation in Iceberg REST Register (CVE-2026-64640)
CVE-2026-64640 is a confused-deputy vulnerability in Apache Polaris: the Iceberg REST register endpoints mint cloud storage credentials for a caller-supplied path and read that path server-side before checking it against the catalog's allowedLocations. A…
Apache Tika PDF Parser XXE via Crafted XFA Form (CVE-2025-54988)
Apache Tika's PDF parser processes an embedded XFA (XML Forms Architecture) form's XML content with external entity resolution enabled. A crafted PDF whose AcroForm dictionary contains an /XFA key pointing to a stream object holding malicious XFA XML can…
Alibaba Fastjson 1.x checkAutoType Bypass to Remote Code Execution via jar:http SSRF and fd-Reread Trick (CVE-2026-16723)
CVE-2026-16723 is a critical, unauthenticated remote code execution vulnerability in Alibaba Fastjson 1.2.68 through 1.2.83, actively exploited in the wild against Spring Boot fat-JAR deployments. Under Fastjson stock defaults (AutoType disabled, SafeMode…
Cisco Unified Communications Manager WebDialer SSRF → Arbitrary File Write → Root (CVE-2026-20230)
Cisco Unified Communications Manager's WebDialer service, when enabled, contains an improper-input-validation flaw that allows an unauthenticated remote attacker to conduct server-side request forgery (SSRF) attacks by sending crafted HTTP requests.…
SonicWall SMA1000 WorkPlace SSRF → Internal Erlang RPC Remote Code Execution (CVE-2026-15409)
The SMA1000 WorkPlace interface exposes a websocket-based remote-access proxy (wsproxy) that lets an authenticated remote-access session request a proxied connection to a destination host/port/service combination (e.g. SSH, TELNET). The proxy does not…
ThingsBoard IoT Platform SSRF via SVG Image Upload (CVE-2025-34282)
ThingsBoard versions before 4.2.1 are vulnerable to Server-Side Request Forgery (CWE-918) through its Image Upload Gallery feature. A Tenant Admin can upload a crafted SVG file whose <image xlink:href="..."> (or <pattern>/<image>) element references an…
StoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441)
The StoryChief WordPress plugin exposes an unauthenticated REST webhook endpoint (/wp-json/storychief/webhook) that accepts a JSON payload describing a "published" story, including a data.featuredimage.data.sizes.full field containing a URL. The plugin…
ASP.NET Core Kestrel HTTP Request Smuggling (CVE-2025-55315)
CVE-2025-55315 is an HTTP request-smuggling vulnerability in the Kestrel web server used by ASP.NET Core, caused by Kestrel's chunked-transfer-encoding parser accepting a lone \n in a chunk-size line where the HTTP/1.1 spec requires \r\n. When Kestrel sits…
Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065)
CVE-2025-30065 is an unsafe class-instantiation vulnerability in Apache Parquet Java's parquet-avro module: crafted Avro schema metadata embedded in a Parquet file can force the reading JVM to load and instantiate attacker-named classes. The official 1.15.1…
WordPress User Language Switch Plugin SSRF — CVE-2026-0745
The User Language Switch WordPress plugin exposes an ulsdownloadlanguage AJAX action that accepts a caller-supplied URL (infolanguage) and fetches it server-side to download a language file. The endpoint does not validate or restrict the destination, allowing…
Unauthenticated SSRF in Ech0 via /api/website/title (CVE-2026-35037)
Ech0's GET /api/website/title endpoint fetches a URL supplied by the (unauthenticated) caller to extract a website's title, without restricting the target to safe, external hosts. This allows an unauthenticated attacker to force the Ech0 server to make…
Typebot Unauthenticated Preview-Chat SSRF — CVE-2026-33712
Typebot's preview-chat feature lets a caller submit an arbitrary typebot definition, including server-side "Code" blocks that execute inside an isolated-vm sandbox. In vulnerable versions, the fetch() function exposed to that sandbox called Node's native…
SmarterMail ConnectToHub Unauthenticated SSRF Leading to Remote Command Execution — CVE-2026-24423
SmarterMail's node-clustering feature allows an administrator to point a node at a "hub" server via the connect-to-hub API. The vulnerability is that the admin-level /api/v1/settings/sysadmin/connect-to-hub endpoint requires no authentication, and the server…
Plunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096
Plunk's POST /webhooks/sns endpoint is meant to handle AWS SNS subscription confirmation callbacks, but it fetches the attacker-supplied SubscribeURL field directly via fetch() without ever verifying the AWS SNS message signature. Because the endpoint…
pdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)
CVE-2026-26801 is a Server-Side Request Forgery vulnerability in pdfmake, a popular Node.js PDF generation library. When a document definition (docDefinition) references remote resources in fields such as images, attachments, or files, pdfmake's…
Open WebUI SSRF via HTTP Redirect Bypass of validate_url() (CVE-2026-45401)
Open WebUI v0.9.4 validates user-supplied URLs with a validateurl() function before the server fetches them, intended to block requests to internal/private hosts. However, the validation only checks the initial hostname supplied by the client; when the…
Microsoft Exchange Authenticated Arbitrary File Read via EWS Reference Attachment (CVE-2026-45504)
CVE-2026-45504 is an authenticated arbitrary file read vulnerability in Microsoft Exchange Server. An attacker with valid mailbox credentials authenticates to OWA and, via the Exchange Web Services (EWS) CreateItem/CreateAttachment SOAP calls, creates a…
Mercator Configuration SSRF Chained to Internal Redis RCE (CVE-2026-49345)
This repository contains two Python PoCs that abuse an unvalidated provider URL parameter in Mercator's ConfigurationController::testProvider endpoint, which the server fetches with libcurl. ssrf2scan.py uses the telnet:// scheme to turn the SSRF into a blind…
MagicMirror² Unauthenticated SSRF via `/cors` Endpoint (CVE-2026-42281)
MagicMirror²'s /cors endpoint is designed to proxy cross-origin requests on behalf of the browser, but it performs no validation or allowlisting of the target URL and forwards attacker-controlled headers in both directions. This turns the endpoint into a…
LiteLLM /config/update Broken Access Control (CVE-2026-35029)
LiteLLM's /config/update endpoint does not check the caller's role — any authenticated user holding a valid API key, not just a proxyadmin, can modify the proxy's runtime configuration. This allows registering a malicious pass-through endpoint that can be…
Kan SSRF via Attachment Download Endpoint — CVE-2026-32255
Kan's attachment download proxy endpoint, GET /api/download/attatchment, is intended to stream S3-hosted attachments to clients but instead takes a fully attacker-controlled url query parameter and passes it directly to fetch() on the server with no…
EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534
EspoCRM 9.3.3 blocks direct requests to http://127.0.0.1/... in its /api/v1/Attachment/fromImageUrl endpoint, but the underlying fetch logic does not normalize alternative IPv4 representations of the loopback address (octal, hex, decimal-dword, and…
Chamilo LMS Unauthenticated install.ajax.php SSRF + Open Mail Relay — CVE-2026-33715
Chamilo LMS ships an installation-wizard AJAX endpoint, public/main/inc/ajax/install.ajax.php, that unlike every other AJAX endpoint in the codebase never includes global.inc.php — the file responsible for enforcing session/authentication checks — and remains…
Apache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)
The Apache Flink Kubernetes Operator reconciles FlinkSessionJob (and FlinkDeployment) custom resources by fetching the JAR referenced in spec.job.jarURI from inside its own pod, without validating the URI's scheme, host, or resolved IP address. Any user…
@haxtheweb/open-apis Credential Exposure via SSRF in cacheAddress Endpoint (CVE-2026-46391)
The cacheAddress endpoint in @haxtheweb/open-apis (/api/services/website/cacheAddress) performs a server-side fetch of a URL supplied by the caller without adequately restricting the destination, resulting in a Server-Side Request Forgery (SSRF)…
Cisco Unified CM WebDialer SSRF to Arbitrary File Write / RCE (CVE-2026-20230)
CVE-2026-20230 is a critical server-side request forgery vulnerability in Cisco Unified CM / Unified CM SME caused by improper input validation of HTTP requests processed by the WebDialer component. A remote unauthenticated attacker can chain unauthenticated…
Next.js WebSocket Upgrade SSRF (Self-Hosted) (CVE-2026-44578)
CVE-2026-44578 is a server-side request forgery (SSRF) vulnerability in self-hosted Next.js WebSocket upgrade handling. A crafted HTTP request with Upgrade: websocket can coerce vulnerable versions into proxying to attacker-chosen internal targets on port 80…
Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065)
CVE-2025-30065 is an unsafe deserialization issue in Apache Parquet Java schema handling that can instantiate attacker-controlled classes while parsing malicious Parquet/Avro metadata. The provided PoC demonstrates two practical outcomes: arbitrary command…