https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T22:43:12.754255+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2024-25738 fkie_cve-2024-25738 2026-10-07T22:43:12.756989+00:00

A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini.

 https://vulnerability.circl.lu/vuln/ghsa-wx24-vqrg-m6m5 GHSA-wx24-vqrg-m6m5 — VuFind Server-Side Request Forgery (SSRF) vulnerability 2026-10-07T22:43:12.757086+00:00

Affected: Packagist: vufind/vufind

A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini.

 https://vulnerability.circl.lu/vuln/gsd-2024-25738 gsd-2024-25738 2026-10-07T22:43:12.757125+00:00 gsd-2024-25738