CVE-2026-3958
Received Received - Intake
Server-Side Request Forgery in Woahai321 ListSync JSON Handler

Publication date: 2026-03-11

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-3958
EUVD
EUVD-2026-11476
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
woahai321 listsync to 0.6.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Woahai321 ListSync software up to version 0.6.6, specifically in the requests.post function within the list-sync-main/api_server.py file of the JSON Handler component.

The issue allows an attacker to perform server-side request forgery (SSRF), meaning the attacker can make the server send unauthorized requests to other internal or external systems.

The attack can be carried out remotely, and the exploit has been publicly disclosed. The project was informed early but has not yet responded.

Impact Analysis

This vulnerability can allow an attacker to make the vulnerable server send unauthorized requests to other systems, potentially accessing internal resources or services that are not normally exposed.

Such unauthorized requests could lead to information disclosure, unauthorized actions on internal systems, or further exploitation depending on the internal network configuration.

Because the attack can be performed remotely, it increases the risk of exploitation without physical access.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart