CVE Explorer

CVE-2025-64327

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9f1ba816316fda254c07865f390a47dbebc1e10a4496bdc4e2e5dd8e89223d10

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"ThinkDashboard","vendor":"MatiasDesuu","versions":[{"status":"affected","version":"< 0.6.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"name":"https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae","tags":["x_refsource_MISC"],"url":"https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/references/1

{"name":"https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8","tags":["x_refsource_MISC"],"url":"https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/references/2

{"tags":["exploit"],"url":"https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/adp/0/references/0

{"name":"https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78","tags":["x_refsource_CONFIRM"],"url":"https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:201f19b4805abae5ced7b6e92d766c1619f546aa7dac69ed653dc85d65641d26 · sha256:4a0d0975bb2f8097… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer