CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- budibaseBudibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview8.7 High
- pinchtabPinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation5.8 Medium
- ondata ckan mcp server, ckan-mcp-server +1 moreCKAN MCP Server: SSRF via base_url allows access to internal networks5.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.12 +5 more +7 moreKeycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak5.8 Medium
- wwbn avideoAVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy8.6 High
- agent0ai agent-zerofrdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery5.3 Medium
- taoofagi easegen-admintaoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery5.1 Medium
- admidioAdmidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint6.8 Medium
- akuity kargoKargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration5.1 Medium
- io.spinnaker.clouddriver clouddriver-artifacts, io.spinnaker.orca orca-core +1 moreSpinnaker clouddriver and orca URL validation bypass via underscores in hostnames9.1 Critical
- mattermost, mattermost server +1 moreSSRF bypass via IPv4-mapped IPv6 literals4.3 Medium
- raythaServer-Site Request Forgery in Raytha CMS5.1 Medium
- vanna-ai vannavanna-ai vanna Endpoint __init__.py run_sql server-side request forgery6.9 Medium
- flowci flow-core-xFlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery5.3 Medium
- glowxq glowxq-ojglowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery6.9 Medium
- gift up! up gift cards for wordpress and woocommerceWordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- katsushi kawamori simple blog cardWordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- mailerpress team mailerpressWordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- andy fragen embed pdf viewerWordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- centrifugal centrifugoCentrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL9.3 Critical
- citeum openctiOpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature7.7 High
- @backstage plugin-auth-backend, linuxfoundation backstage +1 more@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch1.7 Low
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery5.3 Medium
- zyddnys manga-image-translatorzyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgery5.3 Medium
- 2fauth2FAuth has Blind SSRF in image parameter allows internal network access and more7.8 High
- woahai321 listsyncWoahai321 ListSync JSON api_server.py requests.post server-side request forgery5.3 Medium
- homeassistant-ai ha-mcp, home assistant mcp server +1 moreha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle5.3 Medium
- b3log siyuanSiYuan has a Full-Read SSRF via /api/network/forwardProxy8.3 High
- useplunk plunkPlunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns9.3 Critical
- openprojectBlind SSRF on OpenProject instance via webhooks3.0 Low
- elated-themes frappeFrappe: Possible SSRF by any authenticated user5.0 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)5.5 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)5.5 Medium
- anchore quillSSRF in Quill via unvalidated URL from Apple notarization log retrieval5.3 Medium
- sunbird sunbirded-portalAn issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed...7.5 High
- flowiseai flowiseFlowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access7.1 High
- kovah linkaceLinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest7.7 High
- sooperset mcp-atlassian, mcp atlassian +1 moreMCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers8.2 High
- microsoft azure mcp server, azure mcp server tools 1.0.0 (npm), azure mcp server tools 1.0.0 (nuget) +3 more +5 moreAzure MCP Server Tools Elevation of Privilege Vulnerability8.8 High
- microsoft azure iot explorerAzure IOT Explorer Spoofing Vulnerability7.5 High
- sap se netweaver application server for abap, sap netweaver application server abap +1 moreServer-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP6.4 Medium
- pdfmakepdfmake is vulnerable to server-side request forgery (SSRF)7.5 High
- budibaseBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)8.9 High
- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 moreSSRF Protection Bypass in vLLM7.1 High
- ikea dirigera, dirigera firmware +1 moreServer-Side Request Forgery (SSRF) in ikea dirigera7.5 High
- opensourcelabs thermakubeAn issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta...9.8 Critical
- bytedeskBytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery5.3 Medium
- bytedeskBytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery5.3 Medium
- continew adminContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery5.1 Medium
- xuxueli xxl-jobxuxueli xxl-job JobInfoController.java server-side request forgery5.3 Medium
- Show moreLoading…