Vulnerabilidades de Friendica
CVEs publicadas que afetam produtos de Friendica: 2 registro(s), com severidade, exploração e correções.
CVE-2026-72597
Média · 6.5
CWE-918 11/08/2026
Friendica Friendica - Server-Side Request Forgery
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.
CVE-2026-72550
Crítica · 9.8
CWE-89 11/08/2026
Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.