CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- lintsinghua deepauditlintsinghua DeepAudit IP Address embedding_config.py server-side request forgery5.3 Medium
- mindsdbMindsDB File Upload security.py clear_filename server-side request forgery5.3 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery5.0 Medium
- webilop user language switchUser Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter5.5 Medium
- tandoor recipesTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import7.7 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 enables internal network scans via an SSRF vulnerability5.0 Medium
- mateuszgbiorczyk converter for media – optimize images | convert webp & avifConverter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src4.8 Medium
- langchain community, langchain-ai langchainjs +1 more@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation4.1 Medium
- gitlabServer-Side Request Forgery (SSRF) in GitLab4.3 Medium
- gitlabServer-Side Request Forgery (SSRF) in GitLab5.4 Medium
- doramart doracmsDoraCMS <= 3.1 UEditor Remote Image Fetch SSRF6.9 Medium
- langchain-ai langchain, langchain core +1 moreLangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages3.7 Low
- microsoft azure devops server, azure devops server 2022 +1 moreAzure DevOps Server Cross-Site Scripting Vulnerability6.5 Medium
- teknolist computer systems software publishing industry and trade inc. okulistikSSRF in Teknolist Computer's Okulistik9.8 Critical
- faraday project faradayFaraday affected by SSRF via protocol-relative URL host override in build_exclusive_url5.8 Medium
- langchain-ai langsmith-sdkLangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection5.8 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via HTTP Redirect6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host5.3 Medium
- techjewel fluent forms pro add on packFluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'5.4 Medium
mcp-run-pythonPyPIOverly permissive Deno configuration in mcp-run-python leads to SSRF5.8 Medium- homarrHomarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping5.3 Medium
- pydantic ai, pydantic-ai, red hat enterprise linux ai (rhel ai) 3 +2 morePydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling8.6 High
- webpackwebpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior3.7 Low
- webpackwebpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects3.7 Low
- bplugins all in one image viewer block – gutenberg block to create image viewer with hyperlinkAll In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint7.2 High
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has SSRF vulnerability in SendDiscordFileBlock9.3 Critical
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has SSRF vulnerability in ReadRSSFeedBlock9.3 Critical
- zentaoZenTao Webhook model.php fetchHook server-side request forgery5.1 Medium
- group-office group office, intermesh groupoffice +1 moreGroup-Office is vulnerable to SSRF and File Read in WOPI service discovery8.2 High
- glpi-project glpiGLPI is Vulnerable to SSRF via Webhooks4.1 Medium
- themegoods grand blogWordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- prasathmani tiny file managerTiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the...4.3 Medium
- ibm business automation workflow containers, business automation workflow traditional, business automation workflow +2 moreXML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -7.1 High
- adguard trusttunnelTrustTunnel has SSRF and private network restriction bypass via numeric address destinations7.1 High
- nocodbNocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality4.9 Medium
- discourseFinalDestination hostname matching allows SSRF protection bypass7.6 High
- ilias, ilias.de ilias learning management system +1 moreILIAS Learning Management System 4.3 - SSRF6.9 Medium
agentos-taskweaverPyPITaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)6.5 Medium- vercel next.jsNext.js: Server-Side Request Forgery in Server Actions on Custom Servers8.3 High
- vercel next.jsNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname8.3 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Server-side request forgery in applications using WebSocket upgrades8.6 High
- bloompixel tablemaster for elementor – advanced responsive tables for elementorTableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter7.2 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`7.1 High
- squidexSquidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration9.1 Critical
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- kyvernoKyverno Cross-Namespace Privilege Escalation via Policy apiCall10.0 Critical
- zalando skipperSkipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName8.1 High
- tp-link omada controllerBlind Server-Side Request Forgery (SSRF) in Omada Controller5.1 Medium
- wpmessiah frontis blocks — block library for the block editorFrontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- Show moreLoading…