Threat database

NiubiGEO versions before 0.3.2 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make the server perform HTTP requests to internal or private network addresses by sending a crafted domain value to the POST /audit-plan endpoint. Exploitation can lead to disclosure of internal network resources or cloud metadata via the plan's siteEvidence JSON response.