CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- qibo cmsQibo CMS headers server-side request forgery5.3 Medium
- moxi624 mogu blog v2moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery6.9 Medium
- langgenius difylanggenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery5.3 Medium
- langgenius difylanggenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery5.3 Medium
- modelscope agentscopemodelscope agentscope _agent_base.py _process_audio_block server-side request forgery6.9 Medium
- modelscope agentscopemodelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery6.9 Medium
- modelscope agentscopemodelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery6.9 Medium
- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 morevibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery5.3 Medium
- No product listedPHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery5.3 Medium
- leepeuker movaryMovary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing7.7 High
- openclawOpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL4.9 Medium
- openclawOpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions4.9 Medium
- openclawOpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes4.9 Medium
- openclawOpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes4.9 Medium
- openclawOpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation6.3 Medium
- openclawOpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass4.9 Medium
- openclawOpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling8.3 High
- openclawOpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes4.9 Medium
- hkuds openharnessOpenHarness SSRF via web_fetch and web_search7.8 High
- prasathmani tinyfilemanagerprasathmani TinyFileManager File Upload filemanager.php server-side request forgery5.3 Medium
- nomios poland greenmodServer-Side Request Forgery in GREENmod6.9 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS5.3 Medium
markhuot/craftqlPackagistCraftql vulnerable to Server-Side Request Forgery7.5 High- langchain langchain-openaiangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding3.1 Low
- langchain langchain-text-splitters, red hat migration toolkit for applications 8, openshift lightspeed +2 more +4 moreLangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass6.5 Medium
- angularAngular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server8.7 High
- flowiseai flowise, flowise-components +1 moreFlowise: APIChain Prompt Injection SSRF in GET/POST API Chains7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass (TOCTOU & Default Insecure)7.1 High
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox7.1 High
- istioIstio Vulnerable to SSRF via RequestAuthentication jwksUri5.0 Medium
- kyvernoKyverno: ServiceAccount token leaked to external servers via apiCall service URL8.1 High
- flowiseFlowise - Server-Side Request Forgery via Execute Flow Base URL6.0 Medium
- flowiseai flowiseFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)5.3 Medium
- nocobase, nocobase @nocobase/plugin-workflow-request +1 moreNocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins6.4 Medium
- weblateWeblate: SSRF via the webhook add-on using unprotected fetch_url()4.1 Medium
- weblateWeblate: SSRF via Project-Level Machinery Configuration5.0 Medium
- weblateWeblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads5.0 Medium
- craftcms cmsCraft CMS has a host header injection leading to SSRF via resource-js endpoint5.5 Medium
- craftcms cmsCraft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations5.5 Medium
- novuhq novuNovu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection8.3 High
- wwbn avideoAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL7.7 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33039 (SSRF)8.6 High
- jellyfinJellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner8.6 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services8.6 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action7.2 High
- kyvernoKyverno before 1.16.2 SSRF via APICall Feature6.9 Medium
- kyvernoKyverno before 1.18.0 Server-Side Request Forgery via apiCall8.3 High
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR...4.1 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI has Blind Server Side Request Forgery in its Image Edit Functionality4.3 Medium
- Show moreLoading…