CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- gotenbergGotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme5.9 Medium
- gotenbergGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook9.4 Critical
- gotenbergGotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes5.3 Medium
- gotenbergGotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v88.2 High
- lookyloo playwrightcapture, playwright capture +1 moreLookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture6.6 Medium
- misp misp-modulesUnsafe remote resource fetching in expansion misp-modules5.8 Medium
- mervinpraison praisonai, praison praisonaiagents +1 moreSSRF bypass in PraisonAI7.7 High
- newapi new api, quantumnous new-api +1 moreNew API: SSRF Filter Bypass via 0.0.0.07.1 High
- tauriTauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands6.1 Medium
- cisco unity connectionCisco Unity Connection Server-Side Request Forgery Vulnerability7.2 High
- wwbn avideoWWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()7.7 High
- wwbn avideoWWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass5.4 Medium
- magicmirrorMagicMirror²: Unauthenticated SSRF via /cors endpoint9.2 Critical
- aas-ee open-websearchOpen-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`8.2 High
- felippe-regazio ssrfcheckssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs8.2 High
- op-engineering link-preview-jsLink Preview JS: vunerable to IPv6 and internal loopback attacks8.7 High
- admidioIncomplete fix for CVE-2026-32812: SSRF in admidio6.8 Medium
- geysermc geyserGeyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL2.4 Low
- saleor requests-hardenedrequests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 65986.5 Medium
- twentyhq twentytwenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization8.3 High
- manomanotech firefighter-incidentFireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft9.9 Critical
- openedx edx-enterpriseOpen edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint8.5 High
- eclipse foundation basyxEclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery8.6 High
- jegstudio gutenverse – ultimate wordpress fse blocks addons & ecosystemGutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'6.4 Medium
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy8.3 High
- openclawOpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation6.9 Medium
- xwiki-contrib macro-plantumlServer-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter4.4 Medium
- linuxcontainers incusIncus blind SSRF via image import preflight HEAD request5.3 Medium
- pixelsock directus-mcppixelsock directus-mcp MCP index.ts validateUrl server-side request forgery5.3 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter7.2 High
- No product listedJeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgery5.3 Medium
- pixelyoursite pro – your smart pixel (tag) managerPixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter7.2 High
- deothemes onaOna <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter4.4 Medium
- No product listedJeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery5.3 Medium
- No product listedJeecgBoot LoadFile Endpoint FileDownloadUtils.jav checkPathTraversalBatch server-side request forgery5.3 Medium
- apache neethiApache Neethi: Unrestricted HTTP Redirect Following in Policy References6.5 Medium
- ibm langflow desktop, langflow desktop +1 moreServer-Side Request Forgery (SSRF) in Langflow URL Component6.5 Medium
- czlonkowski n8n-mcpn8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders8.5 High
- weblateWeblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url5.3 Medium
- gotenbergGotenberg unauthenticated blind SSRF via unfiltered webhook URL6.9 Medium
- gotenbergGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists7.8 High
- No product listedA Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of...5.0 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2...6.5 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14...4.3 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2...4.3 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14...5.4 Medium
- i18next i18next-http-middlewarePath traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters8.2 High
- geopython pygeoapipygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber8.6 High
- algovate xhs-mcpAlgovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery6.9 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services8.5 High
- Show moreLoading…