CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- wwbn avideoAVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints5.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.13 +7 more +9 moreOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1 Low
- saloonSaloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL6.6 Medium
- snowflake streamlitStreamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)4.7 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable to server-side request forgery5.4 Medium
- lemmynet lemmyLemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()6.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable to server-side request forgery5.4 Medium
- ibm websphere application server liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty Server-Side Request Forgery5.4 Medium
wwbn/avideoPackagistAVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php4.9 Medium- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- pinchtabPinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl4.1 Medium
- ellite wallosWallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php7.1 High
- ellite wallosWallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/308407.7 High
- ellite wallosWallos: SSRF via HTTP Proxy Environment Variable8.3 High
- parisneo lollms-webui, lollms web ui +1 moreLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint9.1 Critical
- go-vikunja vikunjaVikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections6.4 Medium
- go-vikunja vikunjaVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources6.4 Medium
- defaultfuction jeson-customer-relationship-management-systemDefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery6.9 Medium
- roadiz core-bundle-dev-appRoadiz has Server-Side Request Forgery (SSRF) in roadiz/documents6.8 Medium
- opensource-workshop connect-cmsConnect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin6.8 Medium
- kalcaddle kodboxkalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery5.3 Medium
- trueleaf apiflowtrueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery6.9 Medium
- benmoody content syndication toolkitContent Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- qrolic performance monitorPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- eagerterrier mimetypes link iconsMimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content8.3 High
- jurajsim post affiliate proPost Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field3.8 Low
- wpxpo wowoptin: next-gen popup maker – create stunning popups and optins for lead generationWowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API7.2 High
- wwbn avideoAVideo has Unauthenticated SSRF via plugin/Live/test.php9.3 Critical
- nimble-platform common@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch8.9 High
- wwbn avideoAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy8.6 High
- blakeblackshear frigateFrigate has SSRF vulnerability in /ffprobe endpoint5.0 Medium
- wwbn avideo-encoderAVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator9.3 Critical
- dataease sqlbotSQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL8.7 High
- suitecrmSuiteCRM vulnerable to authenticated SSRF via PDF export5.0 Medium
- suitecrmSuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet7.1 High
- microsoft exchange online, microsoft 365 copilot chat, exchange online +2 moreMicrosoft Exchange Elevation of Privilege Vulnerability9.9 Critical
- microsoft bingMicrosoft Bing Tampering Vulnerability6.5 Medium
- microsoft purviewMicrosoft Purview Elevation of Privilege Vulnerability8.6 High
- microsoft purviewMicrosoft Purview Elevation of Privilege Vulnerability8.6 High
- microsoft azure cloud shellAzure Cloud Shell Elevation of Privilege Vulnerability10.0 Critical
- open-emr openemrOpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)7.2 High
- wwbn avideoAVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass9.1 Critical
- thephpleague commonmarkleague/commonmark has an embed extension allowed_domains bypass6.3 Medium
- wwbn avideoAVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources5.0 Medium
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS5.3 Medium
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb5.3 Medium
- wwbn avideoAVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation5.5 Medium
- wgstart wgcloudThe backend database management connection test feature in wgcloud v3.6.3 has a server-side...7.5 High
- kanbn kanKan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment9.2 Critical
- kanKan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint8.6 High
- Show moreLoading…