CVE-2026-19340— anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
Possible ATT&CK Techniques 1AI
T1105 · Ingress Tool TransferAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| anubissbe | ProjectHub-Mcp | 5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19340
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Bert Colemont ProjectHub-MCP 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bert Colemont ProjectHub-MCP是Bert Colemont个人开发者的一款项目管理软件。 Bert Colemont ProjectHub-MCP 5.0.0及之前版本存在服务端请求伪造漏洞，该漏洞源于Webhooks API组件中backend-fix/complete_backend.js文件对url参数的操作，可能导致服务端请求伪造。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| anubissbe | ProjectHub-Mcp | 5.0 | cpe:2.3:a:anubissbe:projecthub-mcp:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19340
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19340
请登录查看更多情报信息。
Other References for CVE-2026-19340 (1)
IV. Related Vulnerabilities
Same weakness: CWE-918
- CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiMod - CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSR - CVE-2026-75053
IntelliJ IDEA 2026.2.1前SSRF漏洞 - CVE-2026-75054
IntelliJ IDEA<2026.2.1 OpenAPI SRF漏洞 - CVE-2026-74858
jae-jae fetcher-mcp URL Validation security-credentials fetc
V. Comments for CVE-2026-19340
No comments yet