{"id":"CVE-2026-92931","published":"2026-10-05T14:17:21.323","lastModified":"2026-10-06T18:16:58.430","description":"CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a Server-Side Request Forgery (SSRF) vulnerability in the Progress @progress/sitefinity-nextjs-sdk npm package, allowing remote attackers to make server-side requests to attacker-controlled hosts, potentially exposing sensitive information.","exploitability":"Exploitation requires the attacker to have access to the application and control over the input that triggers the SSRF. Precondition is the use of affected package versions.","blast_radius":"If exploited, the vulnerability could lead to unauthorized access to sensitive information hosted on attacker-controlled servers.","remediation":"Upgrade to version 15.4.8638 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssrf","npm","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:06.270Z"}}