Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6481 vulnerabilities reference this CWE, most recent first.

CVE-2026-105647 (GCVE-0-2026-105647)

Vulnerability from cvelistv5 – Published: 2026-10-05 19:01 – Updated: 2026-10-05 19:52
VLAI
Title
Ghost: Server-Side Request Forgery in Bookmark Fetching
Summary
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
Severity
4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 19:52 UTC
CWE
  • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
TryGhost Ghost Affected: >= 6.54.1, < 6.65.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105647",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T19:52:08.241024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T19:52:13.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Ghost",
          "vendor": "TryGhost",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.54.1, \u003c 6.65.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T19:01:20.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9"
        },
        {
          "name": "https://github.com/TryGhost/Ghost/pull/30918",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TryGhost/Ghost/pull/30918"
        },
        {
          "name": "https://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de"
        },
        {
          "name": "https://github.com/TryGhost/Ghost/releases/tag/v6.65.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.65.0"
        }
      ],
      "source": {
        "advisory": "GHSA-322m-ff4g-9vx9",
        "discovery": "UNKNOWN"
      },
      "title": "Ghost: Server-Side Request Forgery in Bookmark Fetching"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105647",
    "datePublished": "2026-10-05T19:01:20.746Z",
    "dateReserved": "2026-10-05T16:40:39.613Z",
    "dateUpdated": "2026-10-05T19:52:13.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105636 (GCVE-0-2026-105636)

Vulnerability from cvelistv5 – Published: 2026-10-05 18:02 – Updated: 2026-10-07 21:39
VLAI
Title
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
Summary
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.
Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 21:39 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
makeplane plane Affected: < 1.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105636",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T21:39:13.833798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T21:39:44.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plane",
          "vendor": "makeplane",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T18:02:53.127Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h"
        },
        {
          "name": "https://github.com/makeplane/plane/pull/9163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/pull/9163"
        },
        {
          "name": "https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615"
        },
        {
          "name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mq87-52pf-hm3h",
        "discovery": "UNKNOWN"
      },
      "title": "Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105636",
    "datePublished": "2026-10-05T18:02:53.127Z",
    "dateReserved": "2026-10-05T16:40:39.611Z",
    "dateUpdated": "2026-10-07T21:39:44.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105628 (GCVE-0-2026-105628)

Vulnerability from cvelistv5 – Published: 2026-10-05 17:51 – Updated: 2026-10-05 17:57
VLAI
Title
Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
Summary
Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 17:56 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
makeplane plane Affected: < 1.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105628",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T17:56:44.537944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T17:57:41.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plane",
          "vendor": "makeplane",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plane is an open-source project management tool. Prior to 1.4.0, Plane\u0027s OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T17:51:01.044Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5"
        },
        {
          "name": "https://github.com/makeplane/plane/pull/9163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/pull/9163"
        },
        {
          "name": "https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615"
        },
        {
          "name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cv9p-325g-wmv5",
        "discovery": "UNKNOWN"
      },
      "title": "Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105628",
    "datePublished": "2026-10-05T17:51:01.044Z",
    "dateReserved": "2026-10-05T16:40:39.610Z",
    "dateUpdated": "2026-10-05T17:57:41.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105438 (GCVE-0-2026-105438)

Vulnerability from cvelistv5 – Published: 2026-10-05 20:45 – Updated: 2026-10-06 17:41
VLAI
Title
O2OA General url ActionUploadExcelWithUrl server-side request forgery
Summary
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:05 UTC
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3913 records in the last 180 days details
References
URL Tags
https://vuldb.com/vuln/413603 vdb-entrytechnical-description
https://vuldb.com/vuln/413603/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105438 third-party-advisory
https://vuldb.com/submit/983598 third-party-advisory
https://github.com/o2oa/o2oa/issues/210 exploitissue-tracking
https://github.com/o2oa/o2oa/ product
Impacted products
Vendor Product Version
n/a O2OA Affected: 10.0.1-ce
    cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*
Credits
rockmelodeis (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105438",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:05:50.612060Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:41:07.663Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "General Module"
          ],
          "product": "O2OA",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.1-ce"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rockmelodeis (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T20:45:13.878Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413603 | O2OA General url ActionUploadExcelWithUrl server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413603"
        },
        {
          "name": "VDB-413603 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413603/cti"
        },
        {
          "name": "CVE-2026-105438 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105438"
        },
        {
          "name": "Submit #983598 | o2oa \u003c=10.0.1-ce ssrf",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/983598"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/o2oa/o2oa/issues/210"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/o2oa/o2oa/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-05T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-05T15:13:40.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "O2OA General url ActionUploadExcelWithUrl server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105438",
    "datePublished": "2026-10-05T20:45:13.878Z",
    "dateReserved": "2026-10-05T13:08:33.633Z",
    "dateUpdated": "2026-10-06T17:41:07.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105301 (GCVE-0-2026-105301)

Vulnerability from cvelistv5 – Published: 2026-10-05 05:35 – Updated: 2026-10-05 14:55
VLAI
Title
Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls
Summary
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack.
Severity
4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:07 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
redhat CNA under the redhat root
CNA scorecard B 82/100 over 1035 records in the last 180 days details
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-105301 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2545797 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
Create a notification for this product.
Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
Create a notification for this product.
Date Public
2026-10-02 12:19
Credits
Red Hat would like to thank Ahmed (ahmedx90T) for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T13:07:00.467791Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T14:55:01.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-services",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Ahmed (ahmedx90T) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-02T12:19:56.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T05:58:53.892Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-105301"
        },
        {
          "name": "RHBZ#2545797",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545797"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:19:56.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-02T12:19:56.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-105301",
    "datePublished": "2026-10-05T05:35:52.421Z",
    "dateReserved": "2026-10-05T05:26:43.422Z",
    "dateUpdated": "2026-10-05T14:55:01.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105290 (GCVE-0-2026-105290)

Vulnerability from cvelistv5 – Published: 2026-10-05 10:30 – Updated: 2026-10-07 20:47
VLAI
Title
feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery
Summary
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:47 UTC
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3913 records in the last 180 days details
References
Impacted products
Vendor Product Version
feelec-yishu feelcrm-os Affected: 1.0.0
    cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
liaoxijun10086 (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105290",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:47:46.335492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:47:56.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "getCurlData Endpoint"
          ],
          "product": "feelcrm-os",
          "vendor": "feelec-yishu",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liaoxijun10086 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T10:30:15.436Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413471 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413471"
        },
        {
          "name": "VDB-413471 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413471/cti"
        },
        {
          "name": "CVE-2026-105290 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105290"
        },
        {
          "name": "Submit #977520 | feelec-yishu feelcrm-os 1.0.0 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/977520"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/feelec-yishu/feelcrm-os/issues/4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/feelec-yishu/feelcrm-os/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:49:50.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105290",
    "datePublished": "2026-10-05T10:30:15.436Z",
    "dateReserved": "2026-10-04T22:44:26.873Z",
    "dateUpdated": "2026-10-07T20:47:56.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105263 (GCVE-0-2026-105263)

Vulnerability from cvelistv5 – Published: 2026-10-05 08:45 – Updated: 2026-10-05 13:22 X_Open Source
VLAI
Title
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
Summary
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:21 UTC
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3913 records in the last 180 days details
References
Impacted products
Vendor Product Version
n/a Shaarli Affected: 0.16.0
Affected: 0.16.1
Affected: 0.16.2
Affected: 0.16.3
Unaffected: 0.16.4
    cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*
Credits
akiner (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T13:21:50.615758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T13:22:01.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Admin Metadata Endpoint"
          ],
          "product": "Shaarli",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.16.0"
            },
            {
              "status": "affected",
              "version": "0.16.1"
            },
            {
              "status": "affected",
              "version": "0.16.2"
            },
            {
              "status": "affected",
              "version": "0.16.3"
            },
            {
              "status": "unaffected",
              "version": "0.16.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "akiner (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T08:45:13.791Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413464 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413464"
        },
        {
          "name": "VDB-413464 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413464/cti"
        },
        {
          "name": "CVE-2026-105263 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105263"
        },
        {
          "name": "Submit #972906 | Shaarli \u003c= 0.16.3 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/972906"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-85jx-fhrf-q9w7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shaarli/Shaarli/commit/8ca4de8e7c932a684481f5fbb1229fe16de1f4d2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.16.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/shaarli/Shaarli/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-04T23:59:39.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105263",
    "datePublished": "2026-10-05T08:45:13.791Z",
    "dateReserved": "2026-10-04T21:54:30.390Z",
    "dateUpdated": "2026-10-05T13:22:01.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105238 (GCVE-0-2026-105238)

Vulnerability from cvelistv5 – Published: 2026-10-05 06:15 – Updated: 2026-10-05 13:25
VLAI
Title
ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
Summary
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:25 UTC
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3913 records in the last 180 days details
References
Impacted products
Vendor Product Version
ChatGPTNextWeb NextChat Affected: 2.16.0
Affected: 2.16.1
    cpe:2.3:a:nextchat:nextchat:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
geochen (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105238",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T13:25:09.109096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T13:25:17.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:nextchat:nextchat:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Proxy Fallback Handler"
          ],
          "product": "NextChat",
          "vendor": "ChatGPTNextWeb",
          "versions": [
            {
              "status": "affected",
              "version": "2.16.0"
            },
            {
              "status": "affected",
              "version": "2.16.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "geochen (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T06:15:11.244Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413450 | ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413450"
        },
        {
          "name": "VDB-413450 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413450/cti"
        },
        {
          "name": "CVE-2026-105238 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105238"
        },
        {
          "name": "Submit #975707 | https://github.com/ChatGPTNextWeb/ NextChat v2.16.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/975707"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/ChatGPTNextWeb/NextChat/issues/6813"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/ChatGPTNextWeb/NextChat/pull/6884"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ChatGPTNextWeb/NextChat/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-04T18:20:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105238",
    "datePublished": "2026-10-05T06:15:11.244Z",
    "dateReserved": "2026-10-04T16:15:43.837Z",
    "dateUpdated": "2026-10-05T13:25:17.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105214 (GCVE-0-2026-105214)

Vulnerability from cvelistv5 – Published: 2026-10-04 13:10 – Updated: 2026-10-05 20:29
VLAI
Title
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
Summary
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 19:18 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6503 records in the last 180 days details
References
Impacted products
Vendor Product Version
zitadel zitadel Affected: 0 , < 4.16.2 (semver)
Unaffected: 4.16.2 (semver)
    cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-07-29 00:00
Credits
livio-a IAM-marco IbrahimMrpl kanywst
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T19:18:33.913019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T20:29:06.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "lessThan": "4.16.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.16.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.16.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "livio-a"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "IAM-marco"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "IbrahimMrpl"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "kanywst"
        }
      ],
      "datePublic": "2026-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go\u0027s default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-04T13:10:06.642Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-93hm-8q29-c8cr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-93hm-8q29-c8cr"
        },
        {
          "name": "VulnCheck Advisory: Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zitadel-before-4.16.2-ssrf-via-organization-domain-http-verification"
        }
      ],
      "title": "Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105214",
    "datePublished": "2026-10-04T13:10:06.642Z",
    "dateReserved": "2026-10-04T13:02:21.188Z",
    "dateUpdated": "2026-10-05T20:29:06.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105148 (GCVE-0-2026-105148)

Vulnerability from cvelistv5 – Published: 2026-10-04 11:30 – Updated: 2026-10-05 13:30
VLAI
Title
SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
Summary
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:30 UTC
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3913 records in the last 180 days details
References
URL Tags
https://vuldb.com/vuln/413373 vdb-entrytechnical-description
https://vuldb.com/vuln/413373/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105148 third-party-advisory
https://vuldb.com/submit/947817 third-party-advisory
https://gist.github.com/DReazer/6c1fd0ef98900fbbf… exploit
Impacted products
Vendor Product Version
SciPhi-AI R2R Affected: 3.6.0
Affected: 3.6.1
Affected: 3.6.2
Affected: 3.6.3
Affected: 3.6.4
Affected: 3.6.5
Affected: 3.6.6
    cpe:2.3:a:sciphi-ai:r2r:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Snkn0w (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105148",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T13:30:40.198457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T13:30:59.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sciphi-ai:r2r:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Retrieval Completion API Endpoint"
          ],
          "product": "R2R",
          "vendor": "SciPhi-AI",
          "versions": [
            {
              "status": "affected",
              "version": "3.6.0"
            },
            {
              "status": "affected",
              "version": "3.6.1"
            },
            {
              "status": "affected",
              "version": "3.6.2"
            },
            {
              "status": "affected",
              "version": "3.6.3"
            },
            {
              "status": "affected",
              "version": "3.6.4"
            },
            {
              "status": "affected",
              "version": "3.6.5"
            },
            {
              "status": "affected",
              "version": "3.6.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Snkn0w (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-04T11:30:12.942Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413373 | SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413373"
        },
        {
          "name": "VDB-413373 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413373/cti"
        },
        {
          "name": "CVE-2026-105148 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105148"
        },
        {
          "name": "Submit #947817 | SciPhi-AI R2R \u003c=3.6.6 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/947817"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/DReazer/6c1fd0ef98900fbbfa383faa20f731f6"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-03T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-03T20:10:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105148",
    "datePublished": "2026-10-04T11:30:12.942Z",
    "dateReserved": "2026-10-03T18:05:17.570Z",
    "dateUpdated": "2026-10-05T13:30:59.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list