Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
#cwe-918
共收录 2014 条相关情报。
← 返回所有主题Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
CVE-2026-100681
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing u...
CVE-2026-96533
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-s
A weakness has been identified in songxinjianqwe Chat up to...
CVE-2026-97326
A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this i
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element...
CVE-2026-97320
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowle
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that...
CVE-2026-80347
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSa
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
CVE-2026-57232
### Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to `$this->feedIo->re
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDoc...
CVE-2026-97320
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowle
A server-side request forgery flaw was found in the Ansible Automation Platform automation...
CVE-2026-84721
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP...
CVE-2026-84721
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFor...
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
### Impact The control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`)
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
CVE-2026-56678
### Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled `region` value. By supp
9router: Image prefetch DNS rebinding allows SSRF to internal services
CVE-2026-56676
## Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
CVE-2026-96655
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses v
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force t...
CVE-2026-96652
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can i
Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affects Weoll: before 3....
CVE-2026-77112
Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server S
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, all...
CVE-2026-84046
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validat