Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (4045 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-34013 1 Zhyd 1 Oneblog 2024-11-21 4.3 Medium
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
CVE-2022-34011 1 Zhyd 1 Oneblog 2024-11-21 4.3 Medium
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.
CVE-2022-32995 1 Halo 1 Halo 2024-11-21 9.8 Critical
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
CVE-2022-32457 1 Digiwin 1 Business Process Management 2024-11-21 5.3 Medium
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
CVE-2022-31830 1 Baidu 1 Kity Minder 2024-11-21 9.1 Critical
Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
CVE-2022-31827 1 Monstaftp 1 Monstaftp 2024-11-21 9.1 Critical
MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
CVE-2022-31776 1 Ibm 1 Datapower Gateway 2024-11-21 8.8 High
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 228433.
CVE-2022-31393 1 Jizhicms 1 Jizhicms 2024-11-21 9.1 Critical
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
CVE-2022-31390 1 Jizhicms 1 Jizhicms 2024-11-21 9.1 Critical
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
CVE-2022-31386 1 Nbnbk Project 1 Nbnbk 2024-11-21 9.1 Critical
A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
CVE-2022-30579 1 Tibco 2 Spotfire Analytics Platform, Spotfire Server 2024-11-21 7.1 High
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
CVE-2022-30049 1 Ruifang-tech 1 Rebuild 2024-11-21 7.5 High
A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl parameter.
CVE-2022-2912 1 Craw-data Project 1 Craw-data 2024-11-21 4.3 Medium
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
CVE-2022-2900 1 Parse-url Project 1 Parse-url 2024-11-21 9.1 Critical
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
CVE-2022-2756 1 Kavitareader 1 Kavita 2024-11-21 6.5 Medium
Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
CVE-2022-2556 1 Mailchimp 1 Mailchimp For Woocommerce 2024-11-21 2.7 Low
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
CVE-2022-2416 1 Octopus 1 Octopus Server 2024-11-21 5.5 Medium
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
CVE-2022-2352 1 Wpexperts 1 Post Smtp 2024-11-21 7.2 High
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
CVE-2022-2339 1 Xgenecloud 1 Nocodb 2024-11-21 7.5 High
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
CVE-2022-2267 1 Mailchimp 1 Mailchimp For Woocommerce 2024-11-21 4.3 Medium
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example