https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 05:46:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-85345 <p>The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server&#39;s fetch reveals whether an internal resource responds and its HTTP status, but the resource&#39;s contents are not returned to the attacker.</p> <p>The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server&#39;s fetch reveals whether an internal resource responds and its HTTP status, but the resource&#39;s contents are not returned to the attacker.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85345 https://db.gcve.eu/vuln/ghsa-f2mj-x2jj-wjvc <p>The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server&#39;s fetch reveals whether an internal resource responds and its HTTP status, but the resource&#39;s contents are not returned to the attacker.</p> <p>The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server&#39;s fetch reveals whether an internal resource responds and its HTTP status, but the resource&#39;s contents are not returned to the attacker.</p> https://db.gcve.eu/vuln/ghsa-f2mj-x2jj-wjvc