Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery

Posted by Ron E on Sep 03Description Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery (SSRF) vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlled resource and...