CVE-2026-3958

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3958", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-11T12:36:03.541Z", "datePublished": "2026-03-11T21:32:08.751Z", "dateUpdated": "2026-03-12T19:29:05.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-11T21:32:08.751Z"}, "title": "Woahai321 ListSync JSON api_server.py requests.post server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "Woahai321", "product": "ListSync", "versions": [{"version": "0.6.0", "status": "affected"}, {"version": "0.6.1", "status": "affected"}, {"version": "0.6.2", "status": "affected"}, {"version": "0.6.3", "status": "affected"}, {"version": "0.6.4", "status": "affected"}, {"version": "0.6.5", "status": "affected"}, {"version": "0.6.6", "status": "affected"}], "modules": ["JSON Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-11T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-11T13:41:13.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ZAST.AI (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.350388", "name": "VDB-350388 | Woahai321 ListSync JSON api_server.py requests.post server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350388", "name": "VDB-350388 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.768070", "name": "Submit #768070 | Woahai321 list-sync <=0.6.6 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Woahai321/list-sync/issues/79", "tags": ["issue-tracking"]}, {"url": "https://github.com/Woahai321/list-sync/issues/79#issue-3993946476", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:28:55.826066Z", "id": "CVE-2026-3958", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:29:05.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3958", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T19:28:55.826066Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:29:00.676Z"}}], "cna": {"title": "Woahai321 ListSync JSON api_server.py requests.post server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "ZAST.AI (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Woahai321", "modules": ["JSON Handler"], "product": "ListSync", "versions": [{"status": "affected", "version": "0.6.0"}, {"status": "affected", "version": "0.6.1"}, {"status": "affected", "version": "0.6.2"}, {"status": "affected", "version": "0.6.3"}, {"status": "affected", "version": "0.6.4"}, {"status": "affected", "version": "0.6.5"}, {"status": "affected", "version": "0.6.6"}]}], "timeline": [{"lang": "en", "time": "2026-03-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-11T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-11T13:41:13.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.350388", "name": "VDB-350388 | Woahai321 ListSync JSON api_server.py requests.post server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350388", "name": "VDB-350388 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.768070", "name": "Submit #768070 | Woahai321 list-sync <=0.6.6 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Woahai321/list-sync/issues/79", "tags": ["issue-tracking"]}, {"url": "https://github.com/Woahai321/list-sync/issues/79#issue-3993946476", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-11T21:32:08.751Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3958", "state": "PUBLISHED", "dateUpdated": "2026-03-12T19:29:05.864Z", "dateReserved": "2026-03-11T12:36:03.541Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-11T21:32:08.751Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["JSON Handler"], "product": "ListSync", "vendor": "Woahai321", "versions": [{"status": "affected", "version": "0.6.0"}, {"status": "affected", "version": "0.6.1"}, {"status": "affected", "version": "0.6.2"}, {"status": "affected", "version": "0.6.3"}, {"status": "affected", "version": "0.6.4"}, {"status": "affected", "version": "0.6.5"}, {"status": "affected", "version": "0.6.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Woahai321 ListSync hasta 0.6.6. Este problema afecta la funci\u00f3n requests.post del archivo list-sync-main/api_server.py del componente Gestor JSON. La manipulaci\u00f3n conduce a falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque es posible llevar a cabo de forma remota. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero no ha respondido a\u00fan."}], "id": "CVE-2026-3958", "lastModified": "2026-06-17T10:44:30.807", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3958", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:28:55.826066Z", "version": "2.0.3"}}]}, "published": "2026-03-11T22:16:36.980", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Woahai321/list-sync/issues/79"}, {"source": "cna@vuldb.com", "url": "https://github.com/Woahai321/list-sync/issues/79#issue-3993946476"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.350388"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.350388"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.768070"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.6.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ListSync", "source": "cna", "vendor": "Woahai321"}, "product": "listsync", "vendor": "woahai321"}], "analysis": {"en": {"generated_at": "2026-03-17T16:20:37.550401+00:00", "value": {"mitigation_remediation": ["Apply any vendor-provided patch or upgrade to a later, unaffected version of ListSync as soon as it becomes available.", "If a patch is not yet released, constrain the application\u2019s outbound network reach by using a firewall or network policy to block unexpected HTTP(S) connections, allowing only whitelisted domains.", "Configure the API server or application to validate or filter URLs before making outbound requests; if the configuration supports a URL whitelist, enforce it.", "Monitor application logs for abnormal outbound request activity and investigate any suspicious connections.", "Regularly run vulnerability scanning tools against the application to detect and remediate similar weaknesses."], "summary": {"action": "Apply Patch", "impact": "Server-Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Affected vendor and product: Woahai321:ListSync. Versions up to and including 0.6.6 are affected. No other vendors or products are listed. Users running version 0.6.6 or earlier should verify if they have been patched or consider upgrading after a fix is released.", "description_and_impact": "The vulnerability resides in the JSON Handler component of Woahai321 ListSync. Specifically the requests.post function in list-sync-main/api_server.py is unvalidated and allows an attacker to forge outbound requests from the server to arbitrary URLs. An attacker can exploit this remotely by crafting a malicious payload that triggers the server to resolve and request internal or external resources, potentially leading to credential leakage, denial of service, or access to sensitive data. The weakness is identified as CWE\u2011918: Server\u2011Side Request Forgery.", "risk_and_exploitability": "The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need remote access to craft the payload and the application must allow outbound requests, a condition often satisfied in typical deployments. Because the flaw is in an external library call, automated exploitation is feasible once a valid endpoint is supplied."}}}}, "created": "2026-03-12T09:55:46.069973+00:00", "updated": "2026-03-20T15:36:54.879997+00:00", "vendors": ["woahai321", "woahai321$PRODUCT$listsync"]}