#cwe-918

共收录 2023 条相关情报。

漏洞预警2026-07-20 发布INFO

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook proce...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP r...

CVE-2026-63769

Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supp...

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal net...

CVE-2026-63730

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the s...

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey templat

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.

CVE-2026-60033

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-07-20 发布INFO

Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method

CVE-2026-63769

Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-07-20 发布INFO

HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-07-20 发布INFO

HyperDX < 2.31.0 SSRF via Webhook Test Endpoint

CVE-2026-63730

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-07-20 发布INFO

LimeSurvey SSRF via REST API Survey Template Host Header

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey templat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-07-20 发布INFO

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), shipped in ma...

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side R

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3...

CVE-2026-62418

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Reso

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-07-20 发布INFO

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side R

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against networ...

CVE-2026-63744

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redire

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers...

CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated us

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking ...

CVE-2026-63736

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-19 发布INFO

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/Inte...

CVE-2026-16223

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file ba

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-19 发布INFO

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/ser...

CVE-2026-16222

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file ba

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-07-19 发布INFO

1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery

CVE-2026-16223

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file ba

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-07-19 发布INFO

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

CVE-2026-16222

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file ba

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918