https://poc.intelseclab.com/tags/ssrf/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025). Status: Patched (Oracle out-of-band Security Alert, October 2025). Affects: Oracle E-Business Suite — Oracle Concurrent Processing product, BI Publisher Integration component (reached via the /OA_HTML/ web tier: configurator/UiServlet and ieshostedsurvey.jsp). Tags: oracle-ebs, oracle-concurrent-processing, bi-publisher-integration, pre-auth, rce, ssrf, crlf-injection, request-smuggling, path-traversal, auth-bypass, xslt, java, cisa-kev, ransomware, cl0p, watchtowr.webCriticaloracle-ebsoracle-concurrent-processingbi-publisher-integrationpre-authrcessrfcrlf-injectionrequest-smugglingpath-traversalauth-bypassxsltjavacisa-kevransomwarecl0pwatchtowrhttps://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/High severity (CVSS 8.1) — cloud · CVE-2026-64640. Status: Patched. Affects: Apache Polaris (Apache Iceberg REST catalog), registerTable and registerView endpoints. Tags: apache-polaris, iceberg, apache-iceberg, credential-vending, confused-deputy, authorization-bypass, cross-tenant, s3, storage, allowed-locations, CWE-441, CWE-639, CWE-918, ssrf, server-side-read, information-disclosure, register-table, register-view.cloudHighapache-polarisicebergapache-icebergcredential-vendingconfused-deputyauthorization-bypasscross-tenants3storageallowed-locationsCWE-441CWE-639CWE-918ssrfserver-side-readinformation-disclosureregister-tableregister-viewhttps://poc.intelseclab.com/pocs/web/2026-07-31_cve-2025-54988-apache-tika-xfa-xxe/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2025-54988-apache-tika-xfa-xxe/Critical severity (CVSS 9.8) — web · CVE-2025-54988 (GHSA-p72g-pv48-7w9x, Apache JIRA TIKA-4459). Status: Weaponized. Affects: Apache Tika - tika-parser-pdf-module (and legacy tika-parsers). Tags: apache-tika, xxe, xfa, pdf-parsing, cwe-611, ssrf, file-disclosure, tika-server.webCriticalapache-tikaxxexfapdf-parsingcwe-611ssrffile-disclosuretika-serverhttps://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-16723-fastjson-rce/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-16723-fastjson-rce/Critical severity (CVSS 9) — web · CVE-2026-16723. Status: PoC (no vendor patch, Fastjson 1.x line unpatched). Affects: Alibaba Fastjson (Java JSON library), packaged inside a Spring Boot executable fat-JAR. Tags: fastjson, deserialization, rce, java, spring-boot, autotype-bypass, jar-protocol, ssrf.webCriticalfastjsondeserializationrcejavaspring-bootautotype-bypassjar-protocolssrfhttps://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Critical severity (CVSS 8.6) — network · CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW). Status: PoC — scanner/tester confirms the WebDialer precondition and SSRF reachability. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service. Tags: cisco, unified-communications-manager, ucm, webdialer, ssrf, cwe-918, unauthenticated, remote, privilege-escalation, kev, actively-exploited.networkCriticalciscounified-communications-managerucmwebdialerssrfcwe-918unauthenticatedremoteprivilege-escalationkevactively-exploitedhttps://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Wed, 15 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Critical severity (CVSS 10) — network · CVE-2026-15409 (SNWLID-2026-0008). Status: Weaponized — unauthenticated, non-root remote code execution confirmed against a real appliance build. Affects: SonicWall SMA1000 Appliance — WorkPlace interface (websocket proxy service). Tags: sonicwall, sma1000, workplace, ssrf, erlang, rpc, cwe-918, unauthenticated, remote, kev, actively-exploited.networkCriticalsonicwallsma1000workplacessrferlangrpccwe-918unauthenticatedremotekevactively-exploitedhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-34282-thingsboard-ssrf-svg-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-34282-thingsboard-ssrf-svg-upload/Critical severity (CVSS 9.1) — web · CVE-2025-34282. Status: Weaponized. Affects: ThingsBoard IoT Platform (Image Upload Gallery / Widget Library). Tags: thingsboard, ssrf, cwe-918, svg, image-upload, iot, python, widget-library, tenant-admin.webCriticalthingsboardssrfcwe-918svgimage-uploadiotpythonwidget-librarytenant-adminhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434pythonhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Critical severity (CVSS 9.9) — network · CVE-2025-55315. Status: Weaponized. Affects: ASP.NET Core Kestrel web server (Microsoft.AspNetCore.Server.Kestrel). Tags: aspnet-core, kestrel, http-request-smuggling, chunked-transfer-encoding, dotnet, python, cwe-444, ssrf, cache-poisoning, webshell-upload.networkCriticalaspnet-corekestrelhttp-request-smugglingchunked-transfer-encodingdotnetpythoncwe-444ssrfcache-poisoningwebshell-uploadhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Critical severity (CVSS 9.8) — misc · CVE-2025-30065. Status: PoC. Affects: Apache Parquet Java (parquet-avro module). Tags: rce, ssrf, unsafe-deserialization, parquet-avro, avro-schema, java-class, jvm, cwe-502, cwe-20, incomplete-fix, java.miscCriticalrcessrfunsafe-deserializationparquet-avroavro-schemajava-classjvmcwe-502cwe-20incomplete-fixjavahttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Medium severity — web · CVE-2026-0745 (GHSA-m38c-5p3m-p7gm). Status: PoC. Affects: WordPress "User Language Switch" plugin. Tags: wordpress, ssrf, plugin-vulnerability, admin-ajax, cwe-918, metadata-endpoint.webMediumwordpressssrfplugin-vulnerabilityadmin-ajaxcwe-918metadata-endpointhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35037-ech0-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35037-ech0-ssrf/High severity — web · CVE-2026-35037. Status: PoC. Affects: lin-snow/Ech0. Tags: ssrf, ech0, unauthenticated, self-hosted, cwe-918, nuclei-template.webHighssrfech0unauthenticatedself-hostedcwe-918nuclei-templatehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33712-typebot-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33712-typebot-ssrf/High severity — web · CVE-2026-33712. Status: PoC. Affects: Typebot (open-source chatbot builder), preview chat endpoint. Tags: ssrf, typebot, isolated-vm, sandbox-escape, cloud-metadata, node-js, unauthenticated, chatbot.webHighssrftypebotisolated-vmsandbox-escapecloud-metadatanode-jsunauthenticatedchatbothttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24423-smartermail-ssrf-connecttohub-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24423-smartermail-ssrf-connecttohub-rce/Critical severity — web · CVE-2026-24423. Status: PoC. Affects: SmarterMail (ConnectToHub / node clustering feature). Tags: ssrf, smartermail, connecttohub, unauthenticated, trust-boundary, rce, mail-server, node-management.webCriticalssrfsmartermailconnecttohubunauthenticatedtrust-boundaryrcemail-servernode-managementhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Critical severity (CVSS 9.3) — cloud · CVE-2026-32096. Status: PoC. Affects: Plunk (useplunk/plunk) email/webhook API. Tags: ssrf, aws-sns, imds, cloud-metadata, plunk, cwe-918, unauthenticated.cloudCriticalssrfaws-snsimdscloud-metadataplunkcwe-918unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/High severity — web · CVE-2026-26801. Status: Weaponized. Affects: pdfmake (Node.js PDF generation library), src/URLResolver.js. Tags: ssrf, pdfmake, node-js, cloud-metadata, aws-imds, cwe-918, credential-theft, data-exfiltration.webHighssrfpdfmakenode-jscloud-metadataaws-imdscwe-918credential-theftdata-exfiltrationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45401-ssrf-exploit/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45401-ssrf-exploit/High severity — web · CVE-2026-45401. Status: PoC. Affects: Open WebUI. Tags: ssrf, open-webui, redirect-bypass, url-validation-bypass, internal-network-access.webHighssrfopen-webuiredirect-bypassurl-validation-bypassinternal-network-accesshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45504-exchange-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45504-exchange-file-read/High severity — web · CVE-2026-45504. Status: PoC. Affects: Microsoft Exchange Server (OWA / EWS). Tags: exchange, owa, ews, file-read, ssrf, ntlm, soap, lfi.webHighexchangeowaewsfile-readssrfntlmsoaplfihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49345-mercator-ssrf-redis-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49345-mercator-ssrf-redis-rce/Critical severity — web · CVE-2026-49345. Status: PoC. Affects: Mercator (sourcentis/mercator vulnerability-management web app), ConfigurationController::testProvider. Tags: ssrf, redis, rce, gopher, webshell, internal-network-pivot, php, mercator.webCriticalssrfredisrcegopherwebshellinternal-network-pivotphpmercatorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42281-magicmirror-cors-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42281-magicmirror-cors-ssrf/Critical severity (CVSS 9.2) — web · CVE-2026-42281. Status: PoC. Affects: MagicMirror². Tags: ssrf, unauthenticated, magicmirror, cloud-metadata, secrets-exfiltration, header-injection, open-proxy, python.webCriticalssrfunauthenticatedmagicmirrorcloud-metadatasecrets-exfiltrationheader-injectionopen-proxypythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35029-litellm-config-broken-access-control/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35029-litellm-config-broken-access-control/High severity (CVSS 8.8) — web · CVE-2026-35029. Status: Weaponized. Affects: LiteLLM proxy. Tags: broken-access-control, litellm, ai-gateway, config-update, ssrf, rce, environment-variable-theft, cwe-863.webHighbroken-access-controllitellmai-gatewayconfig-updatessrfrceenvironment-variable-theftcwe-863https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32255-kan-ssrf-attachment-download/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32255-kan-ssrf-attachment-download/High severity (CVSS 8.6) — web · CVE-2026-32255 (GHSA-qrx8-9hc6-jvqg). Status: PoC. Affects: Kan (kanbn/kan) open-source project management tool. Tags: ssrf, kan, project-management, cwe-918, cloud-metadata, unauthenticated, full-read-ssrf.webHighssrfkanproject-managementcwe-918cloud-metadataunauthenticatedfull-read-ssrfhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33534-espocrm-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33534-espocrm-ssrf/Medium severity — web · CVE-2026-33534. Status: PoC. Affects: EspoCRM 9.3.3. Tags: espocrm, ssrf, cwe-918, ipv4-obfuscation, authenticated, crm, file-upload, python.webMediumespocrmssrfcwe-918ipv4-obfuscationauthenticatedcrmfile-uploadpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33715-chamilo-lms-ssrf-mail-relay/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33715-chamilo-lms-ssrf-mail-relay/High severity (CVSS 7.5) — web · CVE-2026-33715 / GHSA-mxc9-9335-45mc. Status: PoC. Affects: Chamilo LMS 2.0. Tags: ssrf, chamilo-lms, open-relay, unauthenticated, php, symfony-mailer, cwe-918, cwe-306, ajax-endpoint.webHighssrfchamilo-lmsopen-relayunauthenticatedphpsymfony-mailercwe-918cwe-306ajax-endpointhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/High severity — cloud · CVE-2026-40564. Status: PoC. Affects: Apache flink-kubernetes-operator. Tags: ssrf, kubernetes, flink, operator, kubernetes-operator, jarURI, cloud-metadata, crd.cloudHighssrfkubernetesflinkoperatorkubernetes-operatorjarURIcloud-metadatacrdhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46391-haxtheweb-open-apis-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46391-haxtheweb-open-apis-ssrf/High severity — web · CVE-2026-46391 (GHSA-4fg7-f244-3j49). Status: PoC. Affects: @haxtheweb/open-apis (HAXcms/HAX ecosystem web service APIs). Tags: haxtheweb, haxcms, open-apis, ssrf, cwe-918, credential-exposure, cacheaddress.webHighhaxthewebhaxcmsopen-apisssrfcwe-918credential-exposurecacheaddresshttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Critical severity (CVSS 8.6) — network · CVE-2026-20230. Status: Weaponized. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). Tags: SSRF, RCE, Cisco, Unified-Communications-Manager, WebDialer, file-write, webshell, jsp-webshell, CISA-KEV, active-exploitation.networkCriticalSSRFRCECiscoUnified-Communications-ManagerWebDialerfile-writewebshelljsp-webshellCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/High severity (CVSS 8.6) — web · CVE-2026-44578. Status: Weaponized. Affects: Next.js standalone router server (next start). Tags: SSRF, WebSocket, upgrade-request, Next.js, self-hosted, unauthenticated, metadata-service.webHighSSRFWebSocketupgrade-requestNext.jsself-hostedunauthenticatedmetadata-servicehttps://poc.intelseclab.com/pocs/misc/2026-05-16_apache-parquet-unsafe-deserialization-rce/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-05-16_apache-parquet-unsafe-deserialization-rce/Critical severity (CVSS 10) — misc · CVE-2025-30065. Status: Weaponized. Affects: Apache Parquet Java (parquet-avro) schema parsing consumers. Tags: RCE, unsafe-deserialization, parquet-avro, avro-schema, Java, JVM, SSRF, data-pipeline.miscCriticalRCEunsafe-deserializationparquet-avroavro-schemaJavaJVMSSRFdata-pipeline