The vulnerability resides in the JSON Handler component of Woahai321 ListSync. Specifically the requests.post function in list-sync-main/api_server.py is unvalidated and allows an attacker to forge outbound requests from the server to arbitrary URLs. An attacker can exploit this remotely by crafting a malicious payload that triggers the server to resolve and request internal or external resources, potentially leading to credential leakage, denial of service, or access to sensitive data. The weakness is identified as CWE‑918: Server‑Side Request Forgery.

Affected vendor and product: Woahai321:ListSync. Versions up to and including 0.6.6 are affected. No other vendors or products are listed. Users running version 0.6.6 or earlier should verify if they have been patched or consider upgrading after a fix is released.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need remote access to craft the payload and the application must allow outbound requests, a condition often satisfied in typical deployments. Because the flaw is in an external library call, automated exploitation is feasible once a valid endpoint is supplied.