Which versions of SEO Meta Tag Extractor are affected by CVE-2026-10287?

SourceCodester SEO Meta Tag Extractor 1.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to coerce the application into making arbitrary outbound HTTP…

Is there a public PoC exploit available for CVE-2026-10287?

Yes, a public proof-of-concept exploit is available for CVE-2026-10287. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10287?

Within 24 hours: Inventory all instances of SourceCodester SEO Meta Tag Extractor 1.0 in your production environment; implement network segmentation to restrict outbound connectivity from affected servers to only necessary internal systems; enable comprehensive logging of HTTP requests originating from this application. Within 7 days: Evaluate migration to alternative SEO meta tag tools or request a patched version from the vendor; implement Web Application Firewall rules to restrict or monitor the 'url' parameter in /index.php requests. Within 30 days: Either upgrade to a patched release when the vendor releases one or migrate entirely to a replacement product; if retention is unavoidable, deploy additional input validation and IP-based access controls.

SEO Meta Tag Extractor CVE-2026-10287

Q: What is the CVSS score of CVE-2026-10287?

CVE-2026-10287 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33758 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-01 VulDB

GHSA-877v-m842-xq9p

PHP SSRF Seo Meta Tag Extractor Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 20:52 vuln.today

DescriptionCVE.org

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function get_headers of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Server-side request forgery in SourceCodester SEO Meta Tag Extractor 1.0 allows remote unauthenticated attackers to coerce the application into making arbitrary outbound HTTP requests by manipulating the 'url' parameter passed to the get_headers() function in /index.php. Publicly available exploit code exists per VulDB, increasing the likelihood of opportunistic abuse against exposed instances, though no active exploitation has been confirmed via CISA KEV.

Technical ContextAI

SEO Meta Tag Extractor is a small PHP web application distributed by SourceCodester that retrieves and parses HTML meta tags from a user-supplied URL. The vulnerability sits in /index.php where user input from the 'url' parameter is passed directly into PHP's get_headers() function without validation of the scheme, host, or destination. This is a textbook CWE-918 (Server-Side Request Forgery) condition: the server, not the attacker's browser, performs the outbound request, allowing it to reach internal hosts, cloud metadata endpoints (e.g., 169.254.169.254), loopback services, or other resources the attacker could not contact directly.

RemediationAI

No vendor-released patch identified at time of analysis; SourceCodester projects of this type are commonly distributed as one-off code samples without an ongoing maintenance stream. Operators should either remove the application from internet-facing infrastructure or apply manual code fixes in /index.php by validating the user-supplied 'url' parameter against an allowlist of expected schemes (http, https only) and resolving the hostname to verify it is a public, non-internal IP before calling get_headers(), rejecting RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, and IPv6 link-local equivalents. As a network-level compensating control, place the host behind an egress proxy that blocks outbound traffic to internal CIDRs and cloud metadata endpoints - this prevents the most damaging SSRF pivots at the cost of breaking any legitimate internal callouts the app might rely on. Further details are tracked at https://vuldb.com/vuln/367580 and the public PoC is at https://hackmd.io/@Kq4PsjnpQ5WfoMt8ho48LA/By9GXDkyGe.