rootpwn

medium · CVSS v3 4.9 · EPSS 0.00274

CVE-2026-80464

The CVE-2026-80464 vulnerability is a server‑side request forgery (SSRF) flaw in HAVELSAN Inc. Sef – AI Chatbot Platform versions prior to 2

Overview

The CVE-2026-80464 vulnerability is a server‑side request forgery (SSRF) flaw in HAVELSAN Inc. Sef – AI Chatbot Platform versions prior to 2.1. It allows attackers to force the server to make arbitrary HTTP requests, potentially exposing internal resources or exfiltrating data.

Description

Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Impact

SSRF can lead to unauthorized data disclosure, internal network reconnaissance, or execution of internal services. The confidentiality of internal endpoints may be compromised, integrity of data could be altered if the platform interacts with writable services, and availability may be impacted if the platform is overloaded with forged requests. Defenders are primarily the system administrators and security teams managing the chatbot deployment.

Remediation

Because the product is no longer supported, apply the following mitigations: block outbound traffic from the chatbot server to untrusted networks using firewall rules; enable strict outbound request whitelisting; disable or restrict any features that allow external URL input; monitor logs for anomalous outbound requests; consider migrating to a supported platform.

Risk context

With a medium severity score of 4.9 and an EPSS of 0.00274, the likelihood of exploitation is low but the impact can be significant if the chatbot is exposed to the internet. Defenders should treat this as a low‑to‑moderate risk but still implement mitigations promptly.

Affected products

  • HAVELSAN Sef AI Chatbot Platform

Scores

Severity
medium
CVSS v2
6.1
CVSS v3
4.9
CVSS v4
—
EPSS
0.00274

SSRF HAVELSAN AI Chatbot Server‑Side Request Forgery Unsupported Mitigation Network Restriction

← All CVEs

Related CVEs

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-92551

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.

View analysis

medium

CVE-2026-92727

The EmbedPress WordPress plugin (versions ≤4.6.6) contains a stored XSS vulnerability in the slidesShow block attribute. Authenticated users with contributor-level access can inject scripts that run when a page is viewed, enabling defacement or data exfiltration. This flaw allows attackers to compromise site integrity and user confidentiality.

View analysis