CVE-2026-19340CWE-918ssrf

CVE-2026-19340

Medium · published August 9, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-09T11:17Z
References (7)
https://github.com/anubissbe/ProjectHub-Mcp/ · [email protected]https://github.com/anubissbe/ProjectHub-Mcp/issues/176 · [email protected]https://vuldb.com/cve/CVE-2026-19340 · [email protected]https://vuldb.com/submit/865264 · [email protected]https://vuldb.com/vuln/387176 · [email protected]https://vuldb.com/vuln/387176/cti · [email protected]https://github.com/anubissbe/ProjectHub-Mcp/issues/176 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 AUG 06:45Z
    anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
    cvelistv5