CVE-2024-6522

CRITICAL Year: 2024
CVSS v3 Score
9.6
Critical
Weakness Type
CWE-918
View all →

Vulnerability Description

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Related Vulnerabilities

CVE-2018-2445

CRITICAL
CVSS:9.6(Critical)

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting...

CWE-9182018

CVE-2019-8982

CRITICAL
CVSS:9.6(Critical)

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.

CWE-9182019

CVE-2024-0440

CRITICAL
CVSS:9.6(Critical)

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.

CWE-9182024

CVE-2024-27098

CRITICAL
CVSS:9.6(Critical)

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using...

CWE-9182024

CVE-2024-3149

CRITICAL
CVSS:9.6(Critical)

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded lin...

CWE-9182024

CVE-2024-33857

CRITICAL
CVSS:9.6(Critical)

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forg...

CWE-9182024