CVE-2025-64327

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.

• CWE-918

• https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edaePatch
• https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8Release Notes
• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78Exploit, Vendor Advisory
• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78Exploit, Vendor Advisory

Published

Nov 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64321Improper Neutralization of Input Used for LLM Prompting vuln…5.3
• CVE-2025-64322Incorrect Permission Assignment for Critical Resource vulner…5.3
• CVE-2025-64323kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.…5.3
• CVE-2025-64324KubeVirt is a virtual machine management add-on for Kubernet…7.7
• CVE-2025-64325Emby Server is a personal media server. Prior to version 4.8…9
• CVE-2025-64326Weblate is a web based localization tool. In versions 5.14 a…3.5
• CVE-2025-64328FreePBX Endpoint Manager is a module for managing telephony …7.2
• CVE-2025-64329containerd is an open-source container runtime. Versions 1.7…5.5
• CVE-2025-6433If a user visited a webpage with an invalid TLS certificate,…9.8
• CVE-2025-64330Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64331Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64332Suricata is a network IDS, IPS and NSM engine developed by t…7.5