CVE-2022-31386: Nbnbk Project Nbnbk

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.

Affected products

• Nbnbk Project Nbnbk: version 3 only

Published 2022-06-09. Last modified 2026-06-17.