CVE-2026-30404

The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/TTTlw1024/qwe/issues/3	Exploit Issue Tracking
https://github.com/tianshiyeben/wgcloud/issues/98	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:wgstart:wgcloud:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-19 16:16

Updated : 2026-06-17 10:32

NVD link : CVE-2026-30404

Mitre link : CVE-2026-30404

CVE.ORG link : CVE-2026-30404

JSON object : View

Products Affected

wgstart

wgcloud

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-30404", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30404", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T01:08:24.998909Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-19T16:16:02.060", "references": [{"url": "https://github.com/TTTlw1024/qwe/issues/3", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/tianshiyeben/wgcloud/issues/98", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations."}, {"lang": "es", "value": "La caracter\u00edstica de prueba de conexi\u00f3n de gesti\u00f3n de base de datos de backend en wgcloud v3.6.3 tiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). Este problema puede ser explotado para hacer que el servidor env\u00ede peticiones para sondear la red interna, descargar archivos maliciosos de forma remota y realizar otras operaciones peligrosas."}], "lastModified": "2026-06-17T10:32:40.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wgstart:wgcloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE012BD6-0C9B-4F63-957E-78C9565F977C", "versionEndIncluding": "3.6.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}