Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6678 vulnerabilities reference this CWE, most recent first.
CVE-2026-0745 (GCVE-0-2026-0745)
Vulnerability from cvelistv5 – Published: 2026-02-14 06:42 – Updated: 2026-04-16 13:53
VLAI
EPSS
VEX
Title
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
Summary
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-16 13:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webilop | User Language Switch |
Affected:
0 , ≤ 1.6.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T13:52:58.344894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T13:53:08.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Language Switch",
"vendor": "webilop",
"versions": [
{
"lessThanOrEqual": "1.6.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bhumividh Treloges"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the \u0027download_language()\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:51:31.409Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a338-ccf1a6eb226c?source=cve"
},
{
"url": "https://downloads.wordpress.org/plugin/user-language-switch.zip"
},
{
"url": "https://wordpress.org/plugins/user-language-switch/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-language-switch/trunk/uls-options.php#L451"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-language-switch/tags/1.6.10/uls-options.php#L451"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-13T18:30:57.000Z",
"value": "Disclosed"
}
],
"title": "User Language Switch \u003c= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via \u0027info_language\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0745",
"datePublished": "2026-02-14T06:42:27.887Z",
"dateReserved": "2026-01-08T18:43:02.867Z",
"dateUpdated": "2026-04-16T13:53:08.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0688 (GCVE-0-2026-0688)
Vulnerability from cvelistv5 – Published: 2026-04-02 07:39 – Updated: 2026-04-08 16:32
VLAI
EPSS
VEX
Title
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Summary
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-02 13:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pfefferle | Webmention |
Affected:
0 , ≤ 5.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0688",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-02T13:23:17.279236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:32:05.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Webmention",
"vendor": "pfefferle",
"versions": [
{
"lessThanOrEqual": "5.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Duong Quang Hao"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the \u0027Tools::read\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:32:45.483Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02c9beba-dfa5-4a30-8355-62ff9a2630f7?source=cve"
},
{
"url": "https://github.com/pfefferle/wordpress-webmention/blob/057223cee18a9e93b017d0f21db6ea77a7686489/includes/class-tools.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/class-tools.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3494831/webmention"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-07T19:46:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-01T19:17:16.000Z",
"value": "Disclosed"
}
],
"title": "Webmention \u003c= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0688",
"datePublished": "2026-04-02T07:39:34.999Z",
"dateReserved": "2026-01-07T19:31:01.518Z",
"dateUpdated": "2026-04-08T16:32:45.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0686 (GCVE-0-2026-0686)
Vulnerability from cvelistv5 – Published: 2026-04-02 07:39 – Updated: 2026-04-08 16:34
VLAI
EPSS
VEX
Title
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
Summary
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-02 13:44 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pfefferle | Webmention |
Affected:
0 , ≤ 5.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-02T13:44:33.774838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T13:45:20.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Webmention",
"vendor": "pfefferle",
"versions": [
{
"lessThanOrEqual": "5.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Duong Quang Hao"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the \u0027MF2::parse_authorpage\u0027 function via the \u0027Receiver::post\u0027 function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:34:21.028Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08d15c46-d15f-4803-80be-90bf33335c18?source=cve"
},
{
"url": "https://github.com/pfefferle/wordpress-webmention/blob/057223cee18a9e93b017d0f21db6ea77a7686489/includes/handler/class-mf2.php#L878"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/handler/class-mf2.php#L877"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/class-receiver.php#L260"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3494831/webmention"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-07T19:33:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-01T19:17:15.000Z",
"value": "Disclosed"
}
],
"title": "Webmention \u003c= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0686",
"datePublished": "2026-04-02T07:39:35.655Z",
"dateReserved": "2026-01-07T19:18:17.788Z",
"dateUpdated": "2026-04-08T16:34:21.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0682 (GCVE-0-2026-0682)
Vulnerability from cvelistv5 – Published: 2026-01-17 03:24 – Updated: 2026-04-08 17:01
VLAI
EPSS
VEX
Title
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
Summary
The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-20 18:47 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| andy_moyle | Church Admin |
Affected:
0 , ≤ 5.0.28
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T18:47:43.198878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T19:23:48.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Church Admin",
"vendor": "andy_moyle",
"versions": [
{
"lessThanOrEqual": "5.0.28",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phap Nguyen Anh"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the \u0027audio_url\u0027 parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:01:39.665Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181"
},
{
"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181"
},
{
"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3440847%40church-admin\u0026new=3440847%40church-admin\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-08T22:21:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-01-16T14:51:20.000Z",
"value": "Disclosed"
}
],
"title": "Church Admin \u003c= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via \u0027audio_url\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0682",
"datePublished": "2026-01-17T03:24:24.110Z",
"dateReserved": "2026-01-07T18:03:26.237Z",
"dateUpdated": "2026-04-08T17:01:39.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0649 (GCVE-0-2026-0649)
Vulnerability from cvelistv5 – Published: 2026-01-07 00:32 – Updated: 2026-02-23 08:22
VLAI
EPSS
VEX
Title
invoiceninja Migration Import Import.php copy server-side request forgery
Summary
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-07 14:27 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.339720 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.339720 | signaturepermissions-required |
| https://vuldb.com/?submit.721323 | third-party-advisory |
| https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | invoiceninja |
Affected:
5.12.0
Affected: 5.12.1 Affected: 5.12.2 Affected: 5.12.3 Affected: 5.12.4 Affected: 5.12.5 Affected: 5.12.6 Affected: 5.12.7 Affected: 5.12.8 Affected: 5.12.9 Affected: 5.12.10 Affected: 5.12.11 Affected: 5.12.12 Affected: 5.12.13 Affected: 5.12.14 Affected: 5.12.15 Affected: 5.12.16 Affected: 5.12.17 Affected: 5.12.18 Affected: 5.12.19 Affected: 5.12.20 Affected: 5.12.21 Affected: 5.12.22 Affected: 5.12.23 Affected: 5.12.24 Affected: 5.12.25 Affected: 5.12.26 Affected: 5.12.27 Affected: 5.12.28 Affected: 5.12.29 Affected: 5.12.30 Affected: 5.12.31 Affected: 5.12.32 Affected: 5.12.33 Affected: 5.12.34 Affected: 5.12.35 Affected: 5.12.36 Affected: 5.12.37 Affected: 5.12.38 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0649",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-07T14:27:52.863067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-07T14:28:45.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Migration Import"
],
"product": "invoiceninja",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "5.12.0"
},
{
"status": "affected",
"version": "5.12.1"
},
{
"status": "affected",
"version": "5.12.2"
},
{
"status": "affected",
"version": "5.12.3"
},
{
"status": "affected",
"version": "5.12.4"
},
{
"status": "affected",
"version": "5.12.5"
},
{
"status": "affected",
"version": "5.12.6"
},
{
"status": "affected",
"version": "5.12.7"
},
{
"status": "affected",
"version": "5.12.8"
},
{
"status": "affected",
"version": "5.12.9"
},
{
"status": "affected",
"version": "5.12.10"
},
{
"status": "affected",
"version": "5.12.11"
},
{
"status": "affected",
"version": "5.12.12"
},
{
"status": "affected",
"version": "5.12.13"
},
{
"status": "affected",
"version": "5.12.14"
},
{
"status": "affected",
"version": "5.12.15"
},
{
"status": "affected",
"version": "5.12.16"
},
{
"status": "affected",
"version": "5.12.17"
},
{
"status": "affected",
"version": "5.12.18"
},
{
"status": "affected",
"version": "5.12.19"
},
{
"status": "affected",
"version": "5.12.20"
},
{
"status": "affected",
"version": "5.12.21"
},
{
"status": "affected",
"version": "5.12.22"
},
{
"status": "affected",
"version": "5.12.23"
},
{
"status": "affected",
"version": "5.12.24"
},
{
"status": "affected",
"version": "5.12.25"
},
{
"status": "affected",
"version": "5.12.26"
},
{
"status": "affected",
"version": "5.12.27"
},
{
"status": "affected",
"version": "5.12.28"
},
{
"status": "affected",
"version": "5.12.29"
},
{
"status": "affected",
"version": "5.12.30"
},
{
"status": "affected",
"version": "5.12.31"
},
{
"status": "affected",
"version": "5.12.32"
},
{
"status": "affected",
"version": "5.12.33"
},
{
"status": "affected",
"version": "5.12.34"
},
{
"status": "affected",
"version": "5.12.35"
},
{
"status": "affected",
"version": "5.12.36"
},
{
"status": "affected",
"version": "5.12.37"
},
{
"status": "affected",
"version": "5.12.38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gets (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T08:22:03.166Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-339720 | invoiceninja Migration Import Import.php copy server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.339720"
},
{
"name": "VDB-339720 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.339720"
},
{
"name": "Submit #721323 | invoiceninja \u003c= 5.12.38. ssrf",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.721323"
},
{
"tags": [
"exploit"
],
"url": "https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-01-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-01-08T10:11:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "invoiceninja Migration Import Import.php copy server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-0649",
"datePublished": "2026-01-07T00:32:07.531Z",
"dateReserved": "2026-01-06T16:20:31.689Z",
"dateUpdated": "2026-02-23T08:22:03.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0632 (GCVE-0-2026-0632)
Vulnerability from cvelistv5 – Published: 2026-02-09 11:22 – Updated: 2026-04-08 17:34
VLAI
EPSS
VEX
Title
Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
Summary
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the 'saveDataSource' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-09 13:21 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| techjewel | Fluent Forms Pro Add On Pack |
Affected:
0 , ≤ 6.1.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0632",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-09T13:21:53.159076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-09T13:22:06.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Fluent Forms Pro Add On Pack",
"vendor": "techjewel",
"versions": [
{
"lessThanOrEqual": "6.1.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "andrea bocchetti"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the \u0027saveDataSource\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:34:55.867Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3bf470-f966-454d-8df3-0dec4682e883?source=cve"
},
{
"url": "https://fluentforms.com/docs/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-06T00:40:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-02-08T22:49:11.000Z",
"value": "Disclosed"
}
],
"title": "Fluent Forms Pro Add On Pack \u003c= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via \u0027saveDataSource\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0632",
"datePublished": "2026-02-09T11:22:35.952Z",
"dateReserved": "2026-01-06T00:21:53.194Z",
"dateUpdated": "2026-04-08T17:34:55.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0600 (GCVE-0-2026-0600)
Vulnerability from cvelistv5 – Published: 2026-01-14 22:29 – Updated: 2026-01-15 14:51
VLAI
EPSS
VEX
Title
Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration
Summary
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-15 14:50 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.sonatype.com/hc/en-us/articles/47… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Sonatype | Nexus Repository |
Affected:
3.0.0 , < *
(semver)
cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.5.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.5.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.5.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.6.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.6.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.6.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.7.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.7.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.8.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.9.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.10.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.11.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.12.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.12.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.13.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.14.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.15.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.15.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.15.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.16.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.16.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.16.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.17.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.18.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.18.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.19.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.19.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.20.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.20.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.21.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.21.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.21.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.22.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.22.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.23.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.24.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.25.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.25.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.26.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.26.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.27.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.68.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.69.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.70.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.70.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.70.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.70.3:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.71.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.72.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.73.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.74.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.75.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.75.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.76.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.76.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.77.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.78.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.78.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.79.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.80.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.81.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:* cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-15T14:50:50.803243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T14:51:42.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.13.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.14.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.15.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.15.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.15.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.16.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.16.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.16.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.17.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.18.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.18.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.19.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.19.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.20.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.21.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.21.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.21.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.22.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.22.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.23.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.24.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.25.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.25.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.26.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.26.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.27.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.68.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.69.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.70.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.70.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.70.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.70.3:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.71.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.72.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.73.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.74.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.75.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.75.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.76.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.76.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.77.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.78.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.78.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.79.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.80.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.81.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*",
"cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Nexus Repository",
"vendor": "Sonatype",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T22:29:09.256Z",
"orgId": "103e4ec9-0a87-450b-af77-479448ddef11",
"shortName": "Sonatype"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.sonatype.com/hc/en-us/articles/47928855816595"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStarting in version 3.88.0, administrators can configure the private network validation setting to block proxy repositories from accessing private network destinations. Cloud metadata endpoints (169.254.169.254) are always blocked regardless of configuration. See the security documentation at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://help.sonatype.com/en/securing-nexus-repository-manager.html\"\u003ehttps://help.sonatype.com/en/securing-nexus-repository-manager.html\u003c/a\u003e for detailed configuration steps.\u003c/p\u003e"
}
],
"value": "Starting in version 3.88.0, administrators can configure the private network validation setting to block proxy repositories from accessing private network destinations. Cloud metadata endpoints (169.254.169.254) are always blocked regardless of configuration. See the security documentation at https://help.sonatype.com/en/securing-nexus-repository-manager.html for detailed configuration steps."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11",
"assignerShortName": "Sonatype",
"cveId": "CVE-2026-0600",
"datePublished": "2026-01-14T22:29:09.256Z",
"dateReserved": "2026-01-05T12:59:19.155Z",
"dateUpdated": "2026-01-15T14:51:42.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0560 (GCVE-0-2026-0560)
Vulnerability from cvelistv5 – Published: 2026-03-29 17:51 – Updated: 2026-03-30 15:33
VLAI
EPSS
VEX
Title
Server-Side Request Forgery (SSRF) in parisneo/lollms
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 15:33 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| parisneo | parisneo/lollms |
Affected:
unspecified , < 2.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0560",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T15:33:20.974551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T15:33:31.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "parisneo/lollms",
"vendor": "parisneo",
"versions": [
{
"lessThan": "2.2.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-29T17:51:20.708Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/65e43a5e-b902-4369-b738-1825285a3ea5"
},
{
"url": "https://github.com/parisneo/lollms/commit/76a54f0df2df8a5b254aa627d487b5dc939a0263"
}
],
"source": {
"advisory": "65e43a5e-b902-4369-b738-1825285a3ea5",
"discovery": "EXTERNAL"
},
"title": "Server-Side Request Forgery (SSRF) in parisneo/lollms"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2026-0560",
"datePublished": "2026-03-29T17:51:20.708Z",
"dateReserved": "2026-01-01T22:10:15.839Z",
"dateUpdated": "2026-03-30T15:33:31.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0532 (GCVE-0-2026-0532)
Vulnerability from cvelistv5 – Published: 2026-01-14 10:14 – Updated: 2026-09-14 12:04
VLAI
EPSS
VEX
Title
External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
Summary
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 16:17 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://discuss.elastic.co/t/kibana-8-19-10-9-1-1… | |
| https://access.redhat.com/security/cve/CVE-2026-0532 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2429540 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Elastic | Kibana |
Affected:
8.15.0 , ≤ 8.19.9
(semver)
Affected: 9.0.0 , ≤ 9.1.9 (semver) Affected: 9.2.0 , ≤ 9.2.3 (semver) |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:5
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
|
| Red Hat | Red Hat OpenShift distributed tracing 3 |
cpe:/a:redhat:openshift_distributed_tracing:3
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0532",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T16:17:27.816904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T16:18:47.674Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "unaffected",
"packageName": "openshift-logging/cluster-logging-rhel9-operator",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "unaffected",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "unaffected",
"packageName": "openshift-logging/kibana6-rhel8",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "kibana",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "kibana",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3"
],
"defaultStatus": "affected",
"packageName": "rhosdt/tempo-jaeger-query-rhel8",
"product": "Red Hat OpenShift distributed tracing 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "unaffected",
"packageName": "puppet-kibana3",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-14T10:14:57.415Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Kibana. This vulnerability allows an authenticated attacker, with privileges to create or modify connectors, to disclose arbitrary files. The attacker achieves this by submitting a specially crafted configuration for the Google Gemini connector, which the server processes without proper validation, enabling arbitrary network requests and file reads."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:04:34.215Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-0532"
},
{
"name": "RHBZ#2429540",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429540"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0532.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-14T11:00:50.706Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-14T10:14:57.415Z",
"value": "Made public."
}
],
"title": "Kibana: Kibana: Arbitrary file disclosure via specially crafted connector configuration",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kibana",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "8.19.9",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.1.9",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.2.3",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExternal Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts \u0026 Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.\u003c/p\u003e"
}
],
"value": "External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts \u0026 Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads."
}
],
"impacts": [
{
"capecId": "CAPEC-76",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-76 Manipulating Web Input to File System Calls"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T10:14:57.415Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524"
}
],
"source": {
"discovery": "Elastic"
},
"title": "External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector",
"x_generator": {
"engine": "Elastic CVE Publisher 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-0532",
"datePublished": "2026-01-14T10:14:57.415Z",
"dateReserved": "2025-12-19T16:02:39.148Z",
"dateUpdated": "2026-09-14T12:04:34.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0486
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo
Portal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise
data-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).
Both components are in scope because the chain crosses from one to the other:
the Portal discloses a database credential, and the separately installed Agent
executes an injected scheduler job on its own host. In the verified shape the
command ran as `nt authority\system`.
Type: deserialization of untrusted data by unrestricted invocation-type
resolution (CWE-502 primary, with CWE-470 an equally defensible
characterisation of the same mechanism), enabled by insufficiently protected
credentials (CWE-522) under a hard-coded cryptographic key (CWE-321), with
incorrect authorization and missing privilege separation (CWE-863 / CWE-284)
and execution with unnecessary privileges (CWE-250 / CWE-732) contributing.
The entry route works exactly as designed, which is the point. `GET
/api/repository/connection-string` returns the repository database connection
string to a caller holding a repository-management role, encrypted with
`SimpleAES` - an AES-256-CBC construction whose 32-byte key and 16-byte IV are
byte-array literals in the shipped `Dataedo.Settings.dll` and are
byte-identical across builds, with PKCS7 padding and every ciphertext byte
encoded as a three-digit decimal group. Anyone holding a copy of the product
therefore decrypts the response offline; both values are reproduced in the
published proof-of-concept. `GenerateEncryptionKey()` exists at
`Dataedo.Settings:116` and no call path was found that replaces the static
field with its output. A full census counted the same static pair referenced
from 19 assemblies. The recovered login in the tested deployments was `sa`, a
sysadmin-level principal on the repository database - and that database also
holds the Hangfire scheduler storage in the `[Scheduler]` schema.
The sink is on the Agent side. `AgentServiceRegistration.AddScheduler` calls
`AddHangfireServer` twice, once for the `default` queue with a worker count of
one and once for the `priority` queue, and registers no `ITypeResolver`
restriction and no invocation allowlist with either, so Hangfire's default type
resolver will resolve any type name the runtime can load. `FilterInitializer`
then runs `GlobalJobFilters.Clear()` and adds four filters, none of which
constrains execution: `ExecutionCreatingFilter` and `RequestUpdatingFilter` are
`IClientFilter` implementations, which run on the client-side job-creation path
rather than on server-side execution and additionally return early unless the
declaring type implements `ISchedulerTaskExecutor`; `JobCancellationFilter` is
an `IApplyStateFilter` that reacts only to transitions into `DeletedState`;
and `AutomaticRetry` is configured with `Attempts = 0`, which disables retries
and has no bearing on authorization. After `Clear()` nothing in the chain
inspects the invocation type, the declaring type, the method name or the
arguments at execution time. The producer is disciplined and the consumer is
not, and the consumer is the one that executes.
One row into `[Scheduler].Job` plus one row into `[Scheduler].JobQueue` is
therefore enough, and no gadget chain is needed because the invocation document
names the sink directly:
{"Type":"System.Diagnostics.Process, System.Diagnostics.Process",
"Method":"Start",
"ParameterTypes":"[\"System.String\",\"System.String\"]",
"Arguments":"[\"cmd.exe\",\"/c <payload>\"]"}
Three details are load-bearing and none of them is obvious. The `Arguments`
column and the `InvocationData.Arguments` member must both carry the command,
and the latter is a JSON array serialized as a string inside the outer JSON
object, so a Windows path appears with doubled backslashes in the outer
document and quadrupled backslashes in the inner one while the enclosing T-SQL
literal doubles every single quote. `QUOTED_IDENTIFIER` must be ON because the
scheduler schema uses filtered indexes. And the `JobQueue` row must name a
queue the Agent actually polls, otherwise the job exists and is never fetched.
Execution lands on the Agent host as the identity of the Agent process. Two
shapes were observed and both are recorded because they bound the claim:
`whoami` returned `<agent-host>\administrator` when the Agent was launched from
a console under an interactive administrative account, and `nt authority\system`
when it ran resident as a SYSTEM-privileged scheduled task, where filtered
`tasklist` output for PID 4 appended to the same file showed the System process
in session 0 under the Services session name, consistent with a service-context
execution environment. For production the Agent is installed as a Windows
service through `AddWindowsService` with an empty `ServiceConfiguration`, so
the identity is whatever that service is configured with: SYSTEM is what the
default service configuration yielded in the tested shape and is not a claim
about every deployment, and the installer's own service-registration table was
not inspected to finality, so the production service account is an inference
from the host configuration call rather than an artifact-confirmed value.
How confirmation works. The recorded job was assigned identifier 7 and its
state progression was read directly from the storage tables: Enqueued ->
Processing (with the fetching worker's own ServerId recorded) -> Succeeded,
with `PerformanceDuration` of 4 milliseconds and `State.Result` equal to "Can
not serialize the return value". That pair is proof of invocation rather than
of bookkeeping: `Process.Start` returns a live Process object which the
scheduler cannot serialize into its state column, so it records that string,
and a job that had been rejected or never fetched would not have reached
Succeeded at all. A marker file was written on the Agent host by the executed
command. The marker path and the marker token are command-line arguments of the
published tool, and neither the path nor the token from the recorded run is
reproduced here, because both are artefacts of one execution on one host rather
than evidence about the product.
The strongest single piece of evidence in the package is an argument-provenance
control. The first injection attempt wrote a placeholder token into the
`[Scheduler].Job.Arguments` column while the `InvocationData` document was
correct, and the Agent's run log recorded the shell complaining that the
placeholder was not recognized as an internal or external command. That
establishes that the executed arguments came from the database row and not from
any configuration, command line or code path inside the Agent, and it
identified the column mismatch in the same breath. Without it a reviewer could
reasonably ask whether the observed execution was an artefact of the test rig;
with it the causality is direct.
What was deliberately not reproduced. The published tool issues no destructive
command, creates no account, deletes no catalog data and touches no downstream
data source. The static key was validated in both cryptographic directions -
decrypting a production-shaped ciphertext, and building one offline that the
real Agent binary subsequently accepted into its own configuration file and
connected with, which confirms the key, the IV and the encoding independently
of the decryption direction - but no domain-controller or domain-administrative
outcome was attempted, downstream data sources were not accessed, and NetNTLMv2
capture through the outbound-SQL surface described in the adjacent group was
never demonstrated end to end.
Scoring. One score is published: 8.1 High,
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Computed from that vector with
CVSS 3.1 weights: ISS = 1 - (0.44 ^ 3) = 0.914816; Impact under Scope Changed =
7.52 * 0.885816 - 3.25 * (0.870207 ^ 13) = 6.127958; Exploitability = 8.22 *
0.85 * 0.44 * 0.50 * 0.85 = 1.306569, the PR weight being 0.50 precisely
because Scope is Changed; base = 1.08 * 7.434527 = 8.029289; 8.1 after the
ceiling-to-tenth Roundup.
A reading of this chain as zero-click and anonymous is withdrawn, and the
reversal argument is printed because it is more useful than the original claim
was. An earlier reading asserted that an unauthenticated attacker could switch
a running Portal's repository to an attacker-controlled database and that an
already-installed Agent would follow the Portal onto that repository and
execute injected jobs there - an anonymous, remote path to SYSTEM. The Agent
reads its repository connection string from its own configuration file, at
`Dataedo.Agent.Startup/ServicesConfigurator.cs:43`, and exposes no controller
and no remote-configuration endpoint of any kind, so nothing that happens to
the Portal's configuration propagates to an installed Agent. The propagation
leg of the claim does not exist. A second sub-claim fell with it: that a
healthy, already-configured instance can be silently switched to another
repository. `POST /api/repository/set` answers HTTP 409 with an explicit
"already configured" message, `create-on-existing-database` surfaces
`RepositoryAlreadyConfiguredException` through `lastOperation.error`, and the
validator's `IsConfigured` gate was confirmed by experiment; the HTTP 202 from
`connect-and-upgrade` is a fire-and-forget acknowledgement that carries no
information about whether any switch happened, and the subsequent state read
showed the configured repository unchanged. Every figure published here was
computed from the vector printed beside it, and no score built on the withdrawn
premise was carried over.
AC:H carries the two conditions that remain once PR:H is granted: a Dataedo
Agent must actually be attached to that repository database - the Agent is a
separately installed component, and with none attached the injected row is
never fetched and nothing executes - and the attacker must have a network path
to the repository listener. Both held in the verified shape and neither is a
property the product guarantees. PR:H because only a principal holding role
action 11 or above was demonstrated to reach the disclosure, and PR:L is
supported by no evidence in this package. UI:N because no victim click, page
visit or administrator action on the Agent host participates.
Scope is Changed, argued on component and host grounds. The vulnerable
component is the Portal web application, whose authority ends at its own
process, its application-pool or service identity and the set of resources its
role model governs; nothing in that model extends to a second machine. The
impacted component is the Dataedo Agent host - a separately installed
component, running as a separate process under a separate identity on a
separate machine - reached only through a third component, the repository
database, whose credentials are themselves the object of the confidentiality
failure. Two observations make the boundary concrete rather than merely
administrative: the attacker never authenticates to the Agent at all, and the
identity gained is not the Portal's identity in any shape, since the Portal
runs under a web-tier identity while the outcome is a machine-level identity on
a Windows host. What Scope does NOT rest on: it is not justified by the
anonymity of the adjacent group below, which is scored nowhere in this vector;
not by the CORS item or the signing-key item; and not by downstream data-source
compromise, which is a consequence of the Agent-host identity rather than an
independent scope change.
The rejected reading is printed so that the difference is auditable: 6.6
Medium, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, where Impact = 6.42 *
0.914816 = 5.873095 and Exploitability = 8.22 * 0.85 * 0.44 * 0.27 * 0.85 =
0.705547 under the Scope-Unchanged PR weight of 0.27, summing to 6.578642. It
is rejected because the execution demonstrably occurs on another host under
another component's service identity, and scoring it
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | Dataedo Portal |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Dataedo Portal",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo\nPortal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise\ndata-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).\nBoth components are in scope because the chain crosses from one to the other:\nthe Portal discloses a database credential, and the separately installed Agent\nexecutes an injected scheduler job on its own host. In the verified shape the\ncommand ran as `nt authority\\system`.\n\nType: deserialization of untrusted data by unrestricted invocation-type\nresolution (CWE-502 primary, with CWE-470 an equally defensible\ncharacterisation of the same mechanism), enabled by insufficiently protected\ncredentials (CWE-522) under a hard-coded cryptographic key (CWE-321), with\nincorrect authorization and missing privilege separation (CWE-863 / CWE-284)\nand execution with unnecessary privileges (CWE-250 / CWE-732) contributing.\n\nThe entry route works exactly as designed, which is the point. `GET\n/api/repository/connection-string` returns the repository database connection\nstring to a caller holding a repository-management role, encrypted with\n`SimpleAES` - an AES-256-CBC construction whose 32-byte key and 16-byte IV are\nbyte-array literals in the shipped `Dataedo.Settings.dll` and are\nbyte-identical across builds, with PKCS7 padding and every ciphertext byte\nencoded as a three-digit decimal group. Anyone holding a copy of the product\ntherefore decrypts the response offline; both values are reproduced in the\npublished proof-of-concept. `GenerateEncryptionKey()` exists at\n`Dataedo.Settings:116` and no call path was found that replaces the static\nfield with its output. A full census counted the same static pair referenced\nfrom 19 assemblies. The recovered login in the tested deployments was `sa`, a\nsysadmin-level principal on the repository database - and that database also\nholds the Hangfire scheduler storage in the `[Scheduler]` schema.\n\nThe sink is on the Agent side. `AgentServiceRegistration.AddScheduler` calls\n`AddHangfireServer` twice, once for the `default` queue with a worker count of\none and once for the `priority` queue, and registers no `ITypeResolver`\nrestriction and no invocation allowlist with either, so Hangfire\u0027s default type\nresolver will resolve any type name the runtime can load. `FilterInitializer`\nthen runs `GlobalJobFilters.Clear()` and adds four filters, none of which\nconstrains execution: `ExecutionCreatingFilter` and `RequestUpdatingFilter` are\n`IClientFilter` implementations, which run on the client-side job-creation path\nrather than on server-side execution and additionally return early unless the\ndeclaring type implements `ISchedulerTaskExecutor`; `JobCancellationFilter` is\nan `IApplyStateFilter` that reacts only to transitions into `DeletedState`;\nand `AutomaticRetry` is configured with `Attempts = 0`, which disables retries\nand has no bearing on authorization. After `Clear()` nothing in the chain\ninspects the invocation type, the declaring type, the method name or the\narguments at execution time. The producer is disciplined and the consumer is\nnot, and the consumer is the one that executes.\n\nOne row into `[Scheduler].Job` plus one row into `[Scheduler].JobQueue` is\ntherefore enough, and no gadget chain is needed because the invocation document\nnames the sink directly:\n\n {\"Type\":\"System.Diagnostics.Process, System.Diagnostics.Process\",\n \"Method\":\"Start\",\n \"ParameterTypes\":\"[\\\"System.String\\\",\\\"System.String\\\"]\",\n \"Arguments\":\"[\\\"cmd.exe\\\",\\\"/c \u003cpayload\u003e\\\"]\"}\n\nThree details are load-bearing and none of them is obvious. The `Arguments`\ncolumn and the `InvocationData.Arguments` member must both carry the command,\nand the latter is a JSON array serialized as a string inside the outer JSON\nobject, so a Windows path appears with doubled backslashes in the outer\ndocument and quadrupled backslashes in the inner one while the enclosing T-SQL\nliteral doubles every single quote. `QUOTED_IDENTIFIER` must be ON because the\nscheduler schema uses filtered indexes. And the `JobQueue` row must name a\nqueue the Agent actually polls, otherwise the job exists and is never fetched.\n\nExecution lands on the Agent host as the identity of the Agent process. Two\nshapes were observed and both are recorded because they bound the claim:\n`whoami` returned `\u003cagent-host\u003e\\administrator` when the Agent was launched from\na console under an interactive administrative account, and `nt authority\\system`\nwhen it ran resident as a SYSTEM-privileged scheduled task, where filtered\n`tasklist` output for PID 4 appended to the same file showed the System process\nin session 0 under the Services session name, consistent with a service-context\nexecution environment. For production the Agent is installed as a Windows\nservice through `AddWindowsService` with an empty `ServiceConfiguration`, so\nthe identity is whatever that service is configured with: SYSTEM is what the\ndefault service configuration yielded in the tested shape and is not a claim\nabout every deployment, and the installer\u0027s own service-registration table was\nnot inspected to finality, so the production service account is an inference\nfrom the host configuration call rather than an artifact-confirmed value.\n\nHow confirmation works. The recorded job was assigned identifier 7 and its\nstate progression was read directly from the storage tables: Enqueued -\u003e\nProcessing (with the fetching worker\u0027s own ServerId recorded) -\u003e Succeeded,\nwith `PerformanceDuration` of 4 milliseconds and `State.Result` equal to \"Can\nnot serialize the return value\". That pair is proof of invocation rather than\nof bookkeeping: `Process.Start` returns a live Process object which the\nscheduler cannot serialize into its state column, so it records that string,\nand a job that had been rejected or never fetched would not have reached\nSucceeded at all. A marker file was written on the Agent host by the executed\ncommand. The marker path and the marker token are command-line arguments of the\npublished tool, and neither the path nor the token from the recorded run is\nreproduced here, because both are artefacts of one execution on one host rather\nthan evidence about the product.\n\nThe strongest single piece of evidence in the package is an argument-provenance\ncontrol. The first injection attempt wrote a placeholder token into the\n`[Scheduler].Job.Arguments` column while the `InvocationData` document was\ncorrect, and the Agent\u0027s run log recorded the shell complaining that the\nplaceholder was not recognized as an internal or external command. That\nestablishes that the executed arguments came from the database row and not from\nany configuration, command line or code path inside the Agent, and it\nidentified the column mismatch in the same breath. Without it a reviewer could\nreasonably ask whether the observed execution was an artefact of the test rig;\nwith it the causality is direct.\n\nWhat was deliberately not reproduced. The published tool issues no destructive\ncommand, creates no account, deletes no catalog data and touches no downstream\ndata source. The static key was validated in both cryptographic directions -\ndecrypting a production-shaped ciphertext, and building one offline that the\nreal Agent binary subsequently accepted into its own configuration file and\nconnected with, which confirms the key, the IV and the encoding independently\nof the decryption direction - but no domain-controller or domain-administrative\noutcome was attempted, downstream data sources were not accessed, and NetNTLMv2\ncapture through the outbound-SQL surface described in the adjacent group was\nnever demonstrated end to end.\n\nScoring. One score is published: 8.1 High,\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Computed from that vector with\nCVSS 3.1 weights: ISS = 1 - (0.44 ^ 3) = 0.914816; Impact under Scope Changed =\n7.52 * 0.885816 - 3.25 * (0.870207 ^ 13) = 6.127958; Exploitability = 8.22 *\n0.85 * 0.44 * 0.50 * 0.85 = 1.306569, the PR weight being 0.50 precisely\nbecause Scope is Changed; base = 1.08 * 7.434527 = 8.029289; 8.1 after the\nceiling-to-tenth Roundup.\n\nA reading of this chain as zero-click and anonymous is withdrawn, and the\nreversal argument is printed because it is more useful than the original claim\nwas. An earlier reading asserted that an unauthenticated attacker could switch\na running Portal\u0027s repository to an attacker-controlled database and that an\nalready-installed Agent would follow the Portal onto that repository and\nexecute injected jobs there - an anonymous, remote path to SYSTEM. The Agent\nreads its repository connection string from its own configuration file, at\n`Dataedo.Agent.Startup/ServicesConfigurator.cs:43`, and exposes no controller\nand no remote-configuration endpoint of any kind, so nothing that happens to\nthe Portal\u0027s configuration propagates to an installed Agent. The propagation\nleg of the claim does not exist. A second sub-claim fell with it: that a\nhealthy, already-configured instance can be silently switched to another\nrepository. `POST /api/repository/set` answers HTTP 409 with an explicit\n\"already configured\" message, `create-on-existing-database` surfaces\n`RepositoryAlreadyConfiguredException` through `lastOperation.error`, and the\nvalidator\u0027s `IsConfigured` gate was confirmed by experiment; the HTTP 202 from\n`connect-and-upgrade` is a fire-and-forget acknowledgement that carries no\ninformation about whether any switch happened, and the subsequent state read\nshowed the configured repository unchanged. Every figure published here was\ncomputed from the vector printed beside it, and no score built on the withdrawn\npremise was carried over.\n\nAC:H carries the two conditions that remain once PR:H is granted: a Dataedo\nAgent must actually be attached to that repository database - the Agent is a\nseparately installed component, and with none attached the injected row is\nnever fetched and nothing executes - and the attacker must have a network path\nto the repository listener. Both held in the verified shape and neither is a\nproperty the product guarantees. PR:H because only a principal holding role\naction 11 or above was demonstrated to reach the disclosure, and PR:L is\nsupported by no evidence in this package. UI:N because no victim click, page\nvisit or administrator action on the Agent host participates.\n\nScope is Changed, argued on component and host grounds. The vulnerable\ncomponent is the Portal web application, whose authority ends at its own\nprocess, its application-pool or service identity and the set of resources its\nrole model governs; nothing in that model extends to a second machine. The\nimpacted component is the Dataedo Agent host - a separately installed\ncomponent, running as a separate process under a separate identity on a\nseparate machine - reached only through a third component, the repository\ndatabase, whose credentials are themselves the object of the confidentiality\nfailure. Two observations make the boundary concrete rather than merely\nadministrative: the attacker never authenticates to the Agent at all, and the\nidentity gained is not the Portal\u0027s identity in any shape, since the Portal\nruns under a web-tier identity while the outcome is a machine-level identity on\na Windows host. What Scope does NOT rest on: it is not justified by the\nanonymity of the adjacent group below, which is scored nowhere in this vector;\nnot by the CORS item or the signing-key item; and not by downstream data-source\ncompromise, which is a consequence of the Agent-host identity rather than an\nindependent scope change.\n\nThe rejected reading is printed so that the difference is auditable: 6.6\nMedium, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, where Impact = 6.42 *\n0.914816 = 5.873095 and Exploitability = 8.22 * 0.85 * 0.44 * 0.27 * 0.85 =\n0.705547 under the Scope-Unchanged PR weight of 0.27, summing to 6.578642. It\nis rejected because the execution demonstrably occurs on another host under\nanother component\u0027s service identity, and scoring it "
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-209",
"description": "CWE-209",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-321",
"description": "CWE-321",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-346",
"description": "CWE-346",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-347",
"description": "CWE-347",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-470",
"description": "CWE-470",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-502",
"description": "CWE-502",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-732",
"description": "CWE-732",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-942",
"description": "CWE-942",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/15"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/dataedo-portal-repository-connection-string-scheduler-job-agent-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/15"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0486",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/15",
"automated": true,
"contentSha256": "61b32dee00457032b5c9d39c5759cf1b7c38c4d7978d3de7112b0cf70de18d5a",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-13T02:21:33Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:02Z",
"dateUpdated": "2026-11-02T07:30:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0486"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.