Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-19 | 2 | Disclosure2 |
| 2026-06-20 | 1 | Disclosure1 |
CVE-2026-49345 Server-Side Request Forgery in Mercator Prior to Version 2025.05.19 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49345
Post summary
The provided text announces a new Server‑Side Request Forgery vulnerability in Mercator (affecting versions before 2025.05.19), offering technical details but no proof of exploit or active exploitation evidence.
🚨*CVE* CVE-2026-49345 Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerabi… https://www.cve.org/CVERecord?id=CVE-2026-49345 ----- Traducción: CVE-2026-49345 Mer… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑49345 for Mercator, noting it is an SSRF vulnerability affecting versions before 2025.05.19, but offers no PoC, exploit details, or patch information.
CVE-2026-49345 Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerabi… https://www.cve.org/CVERecord?id=CVE-2026-49345
Post summary
A new SSRF vulnerability (CVE-2026-49345) in Mercator affecting versions before 2025.05.19 has been disclosed. No PoC, exploit details, patch info, or evidence of active exploitation is provided.