CVE-2026-10287

SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery

CVSS 6.9 MEDIUMEPSS 0.3%CWE-918

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.9EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

01 Jun 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function get_headers of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

SourceCodester · SEO Meta Tag Extractor

public PoCs found — 1

cve_referencehackmd.io/@Kq4PsjnpQ5WfoMt8ho48LA/By9GXDkyGeunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://hackmd.io/@Kq4PsjnpQ5WfoMt8ho48LA/By9GXDkyGe https://vuldb.com/cve/CVE-2026-10287 https://vuldb.com/submit/825641 https://vuldb.com/vuln/367580 https://vuldb.com/vuln/367580/cti https://www.sourcecodester.com/