Racerz-Fighting

**Name of the Vulnerable Software and Affected Versions** Speakr versions prior to 0.8.20-alpha **Description** Speakr is a self-hosted web application for transcribing audio recordings. The `is safe url()` helper function, used to validate post-login redirect targets, incorrectly applies `urljoin(request.host url, target)` before parsing, while the controller passes the raw target to the `redirect()` function. This allows a scheme-relative input, such as `////evil.com`, to be validated as a same-host URL but interpreted by the browser as a network-path-relative redirect to an external attacker-controlled host via the Location header. **Recommendations** Update to version 0.8.20-alpha.

**Name of the Vulnerable Software and Affected Versions** local-deep-research versions prior to 1.6.10 **Description** A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery (SSRF). The software uses the `validate url` function to perform security checks on the host portion of a URL extracted by `urlparse`. However, a discrepancy exists between how `urlparse` and the `requests` library parse URLs. For example, in the `safe get()` function, `validate url` may identify a URL as pointing to a public IP, while `requests.get` interprets the same URL as pointing to an internal address. This occurs because `urlparse` may treat certain characters, such as backslashes, as regular characters, whereas `requests` may treat them as path characters, allowing an attacker to redirect requests to internal network resources. **Recommendations** Upgrade to version 1.6.10 or later.

**Name of the Vulnerable Software and Affected Versions** Bugsink versions prior to 2.1.3 **Description** A mismatch in URL parsing allows the bypass of webhook URL validation. The system used Python's `urllib.parse.urlparse` for validation but `requests.post` to send the request. For malformed inputs containing backslashes and @, these components may disagree on the target hostname. This allows a URL to appear as an allowlisted public hostname during validation while the HTTP client connects to a different host, such as loopback, private, or non-allowlisted destinations. This results in a Server-Side Request Forgery (SSRF), where the server is induced to make an unintended outbound HTTP POST request. **Recommendations** Update to version 2.1.3. Restrict permissions for users who can configure or modify webhook URLs. Review existing webhook configurations for malformed or unusual URLs. Implement a tightly controlled outbound network policy at the deployment level.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.6.32 **Description** A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery (SSRF). The system uses the ` validate url()` function to perform security checks on the host portion of a URL extracted by `urlparse()`. However, a discrepancy exists between how `urlparse()` and the `requests` library parse certain URLs. For example, in a URL like `http://127.0.0.1:6666@1.1.1.1`, `urlparse()` identifies the hostname as `1.1.1.1` (a public address), while `requests` interprets it as `127.0.0.1` (an internal address). This inconsistency allows requests to be routed to internal network addresses despite passing the initial validation. **Recommendations** Update to version 1.6.32.

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 5.4.4 Description A flaw in JupyterHub allows attackers to create links that redirect users to a JupyterHub login page, and then to an attacker-controlled site instead of a legitimate JupyterHub page. This bypasses JupyterHub's security checks. Recommendations Upgrade to JupyterHub version 5.4.4.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.3.22 **Description** Windows media loaders fail to perform local-path validation before accepting remote-host file URLs and UNC-style paths (Universal Naming Convention, a standard for specifying the location of shared resources on a network). This allows attackers to provide network-hosted file targets that the system treats as local content, bypassing intended access restrictions. **Recommendations** Update to version 2026.3.22.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.15.1 vLLM version 0.17.0 **Description** vLLM is an inference and serving engine for large language models (LLMs). A Server-Side Request Forgery (SSRF) protection mechanism implemented in version 0.15.1 can be bypassed in the `load from url async` method. This bypass occurs due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The validation layer uses `urllib3.util.parse url()` while the HTTP client uses `aiohttp` with the `yarl` library for URL parsing. These parsers handle backslash characters (``) differently, allowing an attacker to bypass the hostname allowlist check and potentially access arbitrary internal or external services, resulting in a full SSRF attack. The vulnerable component is located in the `vllm/connections.py` file, specifically within the `load from url async` function. The attack scenario involves providing a malicious URL such as `https://httpbin.org@evil.com/`. **Recommendations** Versions prior to 0.15.1: Update to version 0.15.1 or later. Version 0.17.0: Update to a newer version that addresses the inconsistent URL parsing behavior.

Name of the Vulnerable Software and Affected Versions: WinterChenS my-site versions through commit 6c79286 (2025-06-11) Description: An authentication bypass allows unauthorized access to the `/admin/` API without a token. Recommendations: Versions prior to commit 6c79286 (2025-06-11) should be updated.

Name of the Vulnerable Software and Affected Versions: itranswarp versions up to 2.19 Description: Incorrect access control in the `doFilter` function allows attackers to access sensitive components without authentication. Recommendations: Update itranswarp to a version later than 2.19.

**Name of the Vulnerable Software and Affected Versions** jeeweb-mybatis-springboot version 0.0.1.RELEASE **Description** The issue is related to incorrect access control in the component `/admin/sys/datasource/ajaxList` of jeeweb-mybatis-springboot, allowing attackers to access sensitive information via a crafted payload. This can lead to unauthorized information disclosure. **Recommendations** For jeeweb-mybatis-springboot version 0.0.1.RELEASE, consider restricting access to the `/admin/sys/datasource/ajaxList` endpoint until a patch is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional security controls. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** production ssm version v0.0.1-SNAPSHOT **Description** The issue is related to incorrect access control in the component /user/list, which allows attackers to access sensitive information via a crafted payload. **Recommendations** For production ssm version v0.0.1-SNAPSHOT, consider restricting access to the /user/list component until a proper fix is applied. As a temporary workaround, review and enforce strict access controls to sensitive information.

**Name of the Vulnerable Software and Affected Versions** itranswarp version 2.19 **Description** An issue in the component /manage/ of itranswarp allows attackers to bypass authentication via a crafted request. **Recommendations** For version 2.19, consider restricting access to the /manage/ component until a patch is available. As a temporary workaround, avoid using the crafted request that allows attackers to bypass authentication.

**Name of the Vulnerable Software and Affected Versions** Xinguan version 0.0.1-SNAPSHOT **Description** The issue is related to incorrect access control in the "/system/user/findUserList" API endpoint, which allows attackers to access sensitive information by sending a crafted payload. **Recommendations** For Xinguan version 0.0.1-SNAPSHOT, consider restricting access to the "/system/user/findUserList" API endpoint until a patch is available. As a temporary workaround, avoid using this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** kob version 1.0.0-SNAPSHOT **Description** The issue is related to incorrect access control in the `doFilter()` function, which allows attackers to access sensitive information by sending a crafted payload. **Recommendations** For version 1.0.0-SNAPSHOT, consider restricting access to the `doFilter()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PassJava-Platform version 3.0.0 **Description** The issue is related to incorrect access control in the component "/scheduleLog/info/1" of PassJava-Platform, allowing attackers to access sensitive information via a crafted payload. **Recommendations** For PassJava-Platform version 3.0.0, consider restricting access to the "/scheduleLog/info/1" component until a patch is available. As a temporary workaround, avoid using crafted payloads that could exploit the incorrect access control in this component.

**Name of the Vulnerable Software and Affected Versions** hope-boot version 1.0.0 **Description** The issue is related to incorrect access control in the "/user/edit/" component, which allows attackers to bypass authentication by sending a crafted GET request. **Recommendations** For hope-boot version 1.0.0, consider restricting access to the `/user/edit/` component until a patch is available. As a temporary workaround, review and strengthen authentication mechanisms to prevent bypass attacks.

**Name of the Vulnerable Software and Affected Versions** xmall version 1.1 **Description** The issue is related to incorrect access control, allowing attackers to bypass authentication. This can be achieved via a crafted GET request to the "/index" API endpoint. **Recommendations** For xmall version 1.1, consider restricting access to the "/index" endpoint until a patch is available. As a temporary workaround, review and strengthen access control mechanisms to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** One version 1.0 **Description** The issue is related to incorrect access control in the component "/api/user/manager" that allows attackers to access sensitive information via a crafted payload. **Recommendations** For version 1.0, as a temporary workaround, consider restricting access to the "/api/user/manager" API endpoint until a patch is available. Avoid using crafted payloads in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** brcc version 1.2.0 **Description** The issue is related to incorrect access control in the "/admin/**" API endpoint, which allows attackers to gain access to Admin rights via a crafted request. **Recommendations** For brcc version 1.2.0, as a temporary workaround, consider restricting access to the "/admin/**" API endpoint until a patch is available. Avoid using this endpoint with untrusted requests to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.6 Description: The issue is related to a flaw in the authentication mechanism, specifically in the `io.dataease.auth.filter.TokenFilter` class, which may lead to unauthorized access. Recommendations: For versions prior to 2.10.6, update to version 2.10.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application until the update can be applied.