CVE-2018-10220

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation

• CWE-918

• https://github.com/mushorg/glastopf/issues/286Exploit, Issue Tracking, Third Party Advisory
• https://github.com/mushorg/glastopf/issues/286Exploit, Issue Tracking, Third Party Advisory

Published

Apr 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10210An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10211An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10212An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10213An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10219baijiacms V3 has physical path leakage via an index.php?mod=…
• CVE-2018-1022A remote code execution vulnerability exists in the way the …
• CVE-2018-10221An issue was discovered in WUZHI CMS V4.1.0. There is a pers…
• CVE-2018-10222An issue was discovered in idreamsoft iCMS V7.0. There is a …
• CVE-2018-10223An issue was discovered in YzmCMS 3.8. There is a CSRF vulne…
• CVE-2018-10224An issue was discovered in YzmCMS 3.8. There is a CSRF vulne…
• CVE-2018-10225thinkphp 3.1.3 has SQL Injection via the index.php s paramet…
• CVE-2018-10227MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link pa…