CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- cloudreveCloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses6.5 Medium
- labring fastgptFastGPT: Shared axios SSRF guard validates only the initial URL before following redirects6.3 Medium
- directusDirectus: SSRF Protection Bypass via 0.0.0.0 in File Import7.7 High
- mervinpraison praisonaiPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl8.4 High
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)8.2 High
- mastergo-design mastergo-magic-mcpmastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery5.3 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)7.7 High
- forgekeep nebula-meshNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`7.7 High
- free5gc smfSimple Machines Forum SSRF via image proxy6.3 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions...6.8 Medium
- aws awslabs.healthlake-mcp-serverAWS HealthLake MCP Server SSRF via Pagination URL9.2 Critical
- julien040 anyqueryAnyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode8.6 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 moreA Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance...10.0 Critical
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)9.6 Critical
facturascripts/facturascriptsPackagistFacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`9.9 Critical- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Information Disclosure Vulnerability6.5 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect4.9 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability5.1 Medium
- bulwarkmail webmailIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets ...7.2 High
- sonatype nexus repository, nexus repository manager +1 moreNexus Repository - SSRF in SSL Certificate Retrieval5.3 Medium
- alextselegidis easyappointmentsEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network2.7 Low
- dan-in-ca sip, sustainable irrigation platform +1 moreSustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL6.3 Medium
- snowflake spark connectorInput Validation Vulnerabilities in Snowflake Spark Connector9.2 Critical
- louisho5 picobotlouisho5 picobot web Tool web.go WebTool.Execute server-side request forgery5.3 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery5.3 Medium
- mosaxiv clawletmosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery5.3 Medium
- mosaxiv clawletmosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery5.3 Medium
- openclawOpenClaw < 2026.6.6 Policy Bypass via CDP Discovery6.3 Medium
- codecentric spring-boot-adminSpring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration7.7 High
- crewaiCrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools8.3 High
- plank laravel-mediableLaravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling5.3 Medium
nukeviet/nukevietPackagistNukeViet: Pre-authentication SSRF via X-Forwarded-Host7.2 High- decidimDecidim: Push subscriptions can be abused for server-side requests6.4 Medium
- apache gravitinoApache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs6.5 Medium
- themeisle auto featured image (auto post thumbnail)WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- bdthemes instant image generatorWordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- wp swings pdf generator for wordpressWordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- denishua wpjam basicWordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- misp misp-modulesServer-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses8.3 High
- klosk adloopkLOsk adloop write.py _validate_urls server-side request forgery5.3 Medium
- No product listedLogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request...7.3 High
- helicone ai-gatewayHelicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery5.3 Medium
- mervinpraison praisonaiPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend8.4 High
- baptistearno typebot.ioTypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution8.1 High
- misskey-dev misskeyMisskey: SSRF bypass in URL Preview6.9 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: UNC SSRF affecting the management UI on Windows6.5 Medium
- coturnCoturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection7.4 High
- Show moreLoading…