Skip to content
Threat Feed
Subscribe

Product

Xiaobei (<= 5.5.2)

1 brief RSS
critical advisory

Unauthenticated RCE and SSRF in xiaobei via Webhook Injection

The xiaobei product through version 5.5.2 lacks authentication on webhook endpoints, enabling unauthenticated remote code execution via pipeline message injection and server-side request forgery (SSRF) via malicious media URL fetching.

xiaobei webserver vulnerability cve
1r 1t 1c