CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- emlogEmlog vulnerable to Server-Side Request Forgery (SSRF)7.7 High
- go-sonic sonicgo-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery5.1 Medium
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass6.4 Medium
- extendons wordpress & woocommerce scraper plugin, import data from any siteWordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- jthemes genemyWordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- eyoucmsEyouCMS function.php saveRemote server-side request forgery5.3 Medium
- feehi feehicmsFeehiCMS TimThumb timthumb.php server-side request forgery6.9 Medium
- youzifyWordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- hetworks wordpress image shrinkerWordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- hemmelig, hemmeligorg hemmelig.app +1 moreHemmelig has SSRF Filter bypass in Secret Request functionality4.3 Medium
- vvveb vvvebjsA critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server...9.1 Critical
- yunaiv yudao-cloudYunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery5.3 Medium
- teradek, llc vidiu pro, teradek vidiu firmware, vidiu mini firmware +1 more +3 moreTeradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings6.9 Medium
- yannick lefebvre link libraryWordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- 6storage rentalsWordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- bdthemes prime slider – addons for elementorWordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- jnunemaker httpartyhttparty Has Potential SSRF Vulnerability That Leads to API Key Leakage7.8 High
- learningcircuit local deep research, local-deep-research +1 moreLocal Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service6.3 Medium
- hasura graphql, graphql engine +1 moreHasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection6.9 Medium
- cowrieCowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification6.9 Medium
- langflowLangflow vulnerable to Server-Side Request Forgery7.7 High
- bplugins html5 audio player – the ultimate no-code podcast, mp3 & audio playerHTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery7.2 High
- microsoft azure cognitive service for language, azure language +1 moreCustom Question Answering Elevation of Privilege Vulnerability9.9 Critical
- streamaStreama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write8.7 High
- bdthemes prime slider – addons for elementorPrime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery4.3 Medium
- parse-community parse-serverParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter8.3 High
- podcastgenerator, podcastgenerator podcast generator +1 morePodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection5.1 Medium
- red hat openshift container platform 4Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism6.4 Medium
- lmpixels kergeWordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- cteraServer-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows...7.5 High
- weblateWeblate has Server-Side Request Forgery vulnerability5.0 Medium
- ateme titan, titan file +1 moreAteme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability5.3 Medium
- getgrav gravGrav may be vulnerable to SSRF attack via Twig Templates9.1 Critical
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions...4.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method...4.3 Medium
- emplibot – ai content writer with keyword research, infographics, and linking | seo optimized | fully automatedEmplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery4.4 Medium
- kubernetesPortworx Half-Blind SSRF in kube-controller-manager5.8 Medium
- powerjobPowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery5.3 Medium
- yalantis ucropYalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery5.3 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery5.8 Medium
- brightsign, llc brightsign digital signage diagnostic web serverBrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF6.9 Medium
- zcaceres markdownify mcp serverA Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown...7.5 High
- open bmcs openbmcsOpenBMCS Server Side Request Forgery (SSRF) via /php/query.php6.9 Medium
net.dv8tion:JDAMavenJDA (Java Discord API) downloads external URLs when updating message components6.9 Medium- themesinflow hercules coreWordPress Hercules Core plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- zcaceres fetch mcp serverFetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability7.5 High
- zitadelZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login9.3 Critical
- ibm infosphere information serverIBM InfoSphere Information Server Server-Side Request Forgery4.6 Medium
- infinera mtc-9, nokia infinera mtc-9 firmware +1 moreServer Side Request Forgery (SSRF) in the web server of Infinera MTC-98.6 High
- xerrors yuxi-knowxerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery5.1 Medium
- Show moreLoading…