https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:14:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-241720 EUVD-2026-241720 https://cve.radiocsirt.org/vuln/euvd-2026-241720 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52588 <p>Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2.</p> <p>Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52588 https://cve.radiocsirt.org/vuln/ghsa-v8wj-f5c7-pvxf <p><strong>Affected:</strong> npm: @strapi/admin</p> <p>## Description In Strapi latest version, at function Settings -&gt; Webhooks, the application allows us to input a URL in order to create a Webook connection. However, we can input into this field the local domains such as `localhost`, `127.0.0.1`, `0.0.0.0`,.... in order to make the Application fetching into the internal itself, which causes the vulnerability `Server - Side Request Forgery (SSRF)`.</p> <p>## Payloads - `http://127.0.0.1:80` -&gt; `The Port is not open` - `http://127.0.0.1:1337` -&gt; `The Port which Strapi is running on`</p> <p>## Steps to Reproduce - First of all, let&#39;s input the URL `http://127.0.0.1:80` into the `URL` field, and click &#34;Save&#34;.</p> <p></p> <p>- Next, use the &#34;Trigger&#34; function and use Burp Suite to capture the request / response</p> <p></p> <p>- The server return `request to http://127.0.0.1/ failed, reason: connect ECONNREFUSED 127.0.0.1:80`, BECAUSE the `Port 80` is not open, since we are running Strapi on `Port 1337`, let&#39;s change the URL we input above into `http://127.0.0.1:1337`</p> <p></p> <p>- Continue to click the &#34;Trigger&#34; function, use Burp to capture the request / response</p> <p></p> <p>- Next, use the &#34;Trigger&#34; function and use Burp Suite to capture the request / response</p> <p></p> <p>- The server return `request to http://127.0.0.1/ failed, reason: connect ECONNREFUSED 127.0.0.1:80`, BECAUSE the `Port 80` is not open, since we are running Strapi on `Port 1337`, let&#39;s change the URL we input above into `http://127.0.0.1:1337`</p> <p></p> <p>- Continue to click the &#34;Trigger&#34; function, use Burp to capture the request / response</p> <p>![CleanShot 2024-06-04 at 22 53 2…</p> https://cve.radiocsirt.org/vuln/ghsa-v8wj-f5c7-pvxf https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1154 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Strapi ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Strapi ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1154