CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- phpoffice phpspreadsheetPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.2 Critical
- illid share this imageWordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- curlwrong reuse of SMB connection7.5 High
- dell disk library for mainframe dlm2700, disk library for mainframe dlm8700 +1 moreDell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request...4.3 Medium
- xuxueli xxl-jobXuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery5.3 Medium
- nvidia nemoclawNVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component,...6.3 Medium
- No product listedo2oa URL Fetching FileAction.java FileAction server-side request forgery5.3 Medium
- bigsweetpotatostudio hyperchatBigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery6.9 Medium
- tencentcloudbase cloudbase-mcpTencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery6.9 Medium
- pupnppupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion6.9 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery6.9 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery6.9 Medium
- dmitryglhf mcp-url-downloaderdmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery6.9 Medium
- dh1011 auto-favicondh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery5.3 Medium
- joecastrom mcp-chat-studioJoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery6.9 Medium
- alejandroarciniegas mcp-data-visAlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery6.9 Medium
- shadowclonelabs glutamatemcpservers, glutamate mcp servers +1 moreShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery6.9 Medium
- hbai-ltd toonflow-appHBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery5.3 Medium
- bidingcc buildingaiBidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery6.9 Medium
- No product listedTypecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery6.9 Medium
- openclawOpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation2.3 Low
- openclawOpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload6.3 Medium
- No product listedpagekit download server-side request forgery5.1 Medium
- ihatecreatingusernames2 airahub2IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery5.3 Medium
- devlikeapro wahadevlikeapro WAHA API Request media.controller.ts server-side request forgery5.3 Medium
- axiosAxios: no_proxy bypass via IP alias allows SSRF6.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.07.2 High
- lemmynet lemmyLemmy: SSRF in /api/v3/post via Webmention dispatch6.3 Medium
- lemmynet lemmyLemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image6.5 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality4.9 Medium
- withastro @astrojs/cloudflare@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint2.2 Low
- microsoft entra id, entra +1 moreMicrosoft Entra ID Entitlement Management Spoofing Vulnerability10.0 Critical
- microsoft purview ediscoveryMicrosoft Purview eDiscovery Elevation of Privilege Vulnerability8.6 High
- microsoft dynamics 365, dynamics 365 (online) +1 moreMicrosoft Dynamics 365 (online) Spoofing Vulnerability9.3 Critical
- socialengineSocialEngine <= 7.8.0 Blind SSRF via /core/link/preview6.3 Medium
- squidexSquidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction5.5 Medium
- squidexSquidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)7.3 High
- squidexSSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient7.3 High
- squidexSquidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests7.2 High
- wekanWeKan < 8.35 SSRF via Webhook URL6.3 Medium
- flarum frameworkFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)4.9 Medium
- monetrmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh8.3 High
- guardsix logpoint, odbc +1 moreAn issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2...8.5 High
- github enterprise serverServer-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack8.9 High
bagisto/bagistoPackagistBagisto Downloadable Link copy server-side request forgery5.3 Medium- freescout-help-desk freescoutFreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints4.1 Medium
- nicolargo glancesGlances IP Plugin has SSRF via public_api that leads to credential leakage7.3 High
- internlm lmdeployLMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading7.5 High
- vexaVexa Webhook Feature has a SSRF Vulnerability5.8 Medium
- givanz vvvebVvveb < 1.0.8.1 SSRF via oEmbedProxy8.3 High
- Show moreLoading…