CVE-2026-112254

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-918

• https://github.com/agit8or1/clientst0r/
• https://github.com/agit8or1/clientst0r/commit/7e75c6cc6a07621c10be9b07fafd99e89a02e327
• https://github.com/agit8or1/clientst0r/releases/tag/v3.17.587
• https://vuldb.com/cve/CVE-2026-112254
• https://vuldb.com/submit/986798
• https://vuldb.com/vuln/422335
• https://vuldb.com/vuln/422335/cti

Published

Oct 19, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112247A weakness has been identified in Wuxi Wubang Security Softw…4.3
• CVE-2026-112248A security vulnerability has been detected in grandnode gran…4.7
• CVE-2026-112249A vulnerability was detected in grandnode grandnode2 up to 2…2.4
• CVE-2026-11225Inappropriate implementation in WebUI in Google Chrome prior…6.5
• CVE-2026-112251A vulnerability was detected in antoinersx clawhost up to 0.…4.3
• CVE-2026-112252A vulnerability has been found in Wuxi Wubang Security Softw…7.3
• CVE-2026-112257A flaw was found in GIMP. The PSD thumbnail resource loader …7.8
• CVE-2026-112258A flaw was found in GIMP. The XCF loader can leave a danglin…7.8
• CVE-2026-112259A flaw was found in GIMP. Importing a crafted SBZ palette wi…5.5
• CVE-2026-11226Insufficient policy enforcement in PreviewTab in Google Chro…6.5
• CVE-2026-112260A flaw was found in GIMP. Opening a crafted XCF with a malfo…7.1
• CVE-2026-112261A flaw was found in GIMP. Opening a crafted XCF that selects…7.8