https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T09:44:40.587151+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2024-6524 fkie_cve-2024-6524 2026-10-07T09:44:40.589710+00:00

A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF.

 https://vulnerability.circl.lu/vuln/ghsa-c96r-38gv-grp4 GHSA-c96r-38gv-grp4 — ShopXO Server-Side Request Forgery Vulnerability 2026-10-07T09:44:40.589806+00:00

Affected: Packagist: shopxo/shopxo

A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file `extend/base/Uploader.php`. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF.