{"vulnerability": "CVE-2026-101300", "sightings": [{"uuid": "32c87ba5-f2d6-4163-af9d-9167fc172c6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101300", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117449764329579419", "content": "CVE-2026-101300 Server-Side Request Forgery in Wegow PDF export Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.\nhttps://www.cve.org/CVERecord?id=CVE-2026-101300https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-wegow-pdf-export#WegowTechnologies #Wegow#CVE_2026_101300#bot", "creation_timestamp": "2026-10-16T08:59:39.851045Z"}]}