CVE Watch14 de out. de 2026

CVE-2026-85345

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server

CVSS

4.1

Média

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 14 de out. de 2026 · CWE-918

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-142026-11-06

Descrição técnica

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.

Referências oficiais

wpscan.comhttps://wpscan.com/vulnerability/d1a5d12d-a7ce-43e1-b7c5-752453bc97e9/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-755907.2 ALT

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.4h CVE-2026-191287.5 ALT

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.4h CVE-2026-191223.8 BAI

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.4h CVE-2026-188369.3 CRÍ

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.4h CVE-2026-174068.5 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.4h CVE-2026-174048.5 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.4h