CVE-2024-41813

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery (SSRF) vulnerability in the `/proxy` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.6.1 patches the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-418157.0Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/CVE-2024-418165.4Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[co CVE-2024-418177.8ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick`CVE-2024-418187.5fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.CVE-2024-418195.4Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbi CVE-2024-41824.3Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom stat CVE-2024-418206.0Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` res CVE-2024-418246.5In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases CVE-2024-418255.4In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab CVE-2024-418264.8In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page CVE-2024-418279.8In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration CVE-2024-418286.5In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time