Search
Find a vulnerability
Search criteria
4 vulnerabilities found for crawlseo by crawlseo
CVE-2026-115411 (GCVE-0-2026-115411)
Vulnerability from nvd – Published: 2026-10-22 13:20 – Updated: 2026-10-22 13:20 X_Open Source
VLAI
EPSS
VEX
Title
crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
Summary
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crawlseo/crawlseo/commit/76e4e… | issue-tracking |
| https://github.com/crawlseo/crawlseo/releases?pag… | patch |
| https://gist.github.com/mansurmavlankulov/47cb8e1… | technical-description |
| https://www.vulncheck.com/advisories/crawlseo-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crawlseo/crawlseo",
"product": "crawlseo",
"repo": "https://github.com/crawlseo/crawlseo",
"vendor": "crawlseo",
"versions": [
{
"lessThan": "0.2.4",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.4",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mansurzhan Mavlankulov"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page\u0027s title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:20:01.875Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/crawlseo/crawlseo/commit/76e4e693de0c6b294cf1f60656800e47346f1c28"
},
{
"name": "Vendor Patch",
"tags": [
"patch"
],
"url": "https://github.com/crawlseo/crawlseo/releases?page=1#release-v0.2.4"
},
{
"tags": [
"technical-description"
],
"url": "https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"
},
{
"name": "VulnCheck Advisory: crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawlseo-before-server-side-request-forgery-via-crawler"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115411",
"datePublished": "2026-10-22T13:20:01.875Z",
"dateReserved": "2026-10-22T12:20:48.706Z",
"dateUpdated": "2026-10-22T13:20:01.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115400 (GCVE-0-2026-115400)
Vulnerability from nvd – Published: 2026-10-22 13:23 – Updated: 2026-10-22 13:23 X_Open Source
VLAI
EPSS
VEX
Title
crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
Summary
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
Severity
4.4 (Medium)
CWE
- CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crawlseo/crawlseo/releases/tag… | patch |
| https://gist.github.com/mansurmavlankulov/47cb8e1… | technical-description |
| https://github.com/crawlseo/crawlseo/commit/2ce0b… | issue-tracking |
| https://www.vulncheck.com/advisories/crawlseo-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crawlseo/crawlseo",
"product": "crawlseo",
"repo": "https://github.com/crawlseo/crawlseo",
"vendor": "crawlseo",
"versions": [
{
"lessThan": "0.2.5",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.5",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mansurzhan Mavlankulov"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users\u0027 Google Search Console data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:23:38.856Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Patch",
"tags": [
"patch"
],
"url": "https://github.com/crawlseo/crawlseo/releases/tag/v0.2.5"
},
{
"tags": [
"technical-description"
],
"url": "https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/crawlseo/crawlseo/commit/2ce0b4b2bdd6047e0a9ede037fd355381968d9bc"
},
{
"name": "VulnCheck Advisory: crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawlseo-before-cleartext-storage-of-google-oauth-tokens"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115400",
"datePublished": "2026-10-22T13:23:38.856Z",
"dateReserved": "2026-10-22T11:33:47.671Z",
"dateUpdated": "2026-10-22T13:23:38.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115400 (GCVE-0-2026-115400)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:23 – Updated: 2026-10-22 13:23 X_Open Source
VLAI
EPSS
VEX
Title
crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
Summary
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
Severity
4.4 (Medium)
CWE
- CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crawlseo/crawlseo/releases/tag… | patch |
| https://gist.github.com/mansurmavlankulov/47cb8e1… | technical-description |
| https://github.com/crawlseo/crawlseo/commit/2ce0b… | issue-tracking |
| https://www.vulncheck.com/advisories/crawlseo-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crawlseo/crawlseo",
"product": "crawlseo",
"repo": "https://github.com/crawlseo/crawlseo",
"vendor": "crawlseo",
"versions": [
{
"lessThan": "0.2.5",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.5",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mansurzhan Mavlankulov"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users\u0027 Google Search Console data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:23:38.856Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Patch",
"tags": [
"patch"
],
"url": "https://github.com/crawlseo/crawlseo/releases/tag/v0.2.5"
},
{
"tags": [
"technical-description"
],
"url": "https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/crawlseo/crawlseo/commit/2ce0b4b2bdd6047e0a9ede037fd355381968d9bc"
},
{
"name": "VulnCheck Advisory: crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawlseo-before-cleartext-storage-of-google-oauth-tokens"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115400",
"datePublished": "2026-10-22T13:23:38.856Z",
"dateReserved": "2026-10-22T11:33:47.671Z",
"dateUpdated": "2026-10-22T13:23:38.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115411 (GCVE-0-2026-115411)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:20 – Updated: 2026-10-22 13:20 X_Open Source
VLAI
EPSS
VEX
Title
crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
Summary
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crawlseo/crawlseo/commit/76e4e… | issue-tracking |
| https://github.com/crawlseo/crawlseo/releases?pag… | patch |
| https://gist.github.com/mansurmavlankulov/47cb8e1… | technical-description |
| https://www.vulncheck.com/advisories/crawlseo-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crawlseo/crawlseo",
"product": "crawlseo",
"repo": "https://github.com/crawlseo/crawlseo",
"vendor": "crawlseo",
"versions": [
{
"lessThan": "0.2.4",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.4",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mansurzhan Mavlankulov"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page\u0027s title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:20:01.875Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/crawlseo/crawlseo/commit/76e4e693de0c6b294cf1f60656800e47346f1c28"
},
{
"name": "Vendor Patch",
"tags": [
"patch"
],
"url": "https://github.com/crawlseo/crawlseo/releases?page=1#release-v0.2.4"
},
{
"tags": [
"technical-description"
],
"url": "https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"
},
{
"name": "VulnCheck Advisory: crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawlseo-before-server-side-request-forgery-via-crawler"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115411",
"datePublished": "2026-10-22T13:20:01.875Z",
"dateReserved": "2026-10-22T12:20:48.706Z",
"dateUpdated": "2026-10-22T13:20:01.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}