| शीर्षक | Refly AI refly <=1.1.0 Server-Side Request Forgery |
|---|
| विवरण | Refly 1.1.0 is affected by a server-side request forgery (SSRF) vulnerability. Authenticated API endpoints fetch a caller-supplied URL from the application server without restricting the destination host, address range, or URL scheme beyond the runtime HTTP client. A remote attacker with a valid user session can cause the server to issue HTTP requests to internal network locations, including loopback and adjacent services on the deployment network, and obtain the retrieved content. Unauthenticated access to the affected endpoints is not sufficient to exploit this issue. |
|---|
| स्रोत | ⚠️ https://github.com/DReazer/CV3/blob/main/refly/SSRF.md |
|---|
| उपयोगकर्ता | Snkn0w (UID 90071) |
|---|
| सबमिशन | 14/08/2026 09:38 AM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 07:07 PM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 403874 [refly-ai Refly तक 1.1.0 /v1/misc/scrape अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|