CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- rrwo plack::app::prerenderPlack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call9.1 Critical
- beaugunderson ip-addressip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks6.9 Medium
- arista networks velocloud orchestrator on-premVeloCloud Orchestrator Missing Input Validation SSRF6.3 Medium
- themeisle feedzyWordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- wpcenter affiliatexWordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- shahadat hossain 3d flipbook pdf viewer & embedderWordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- moonshotai kimi codeKimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects5.5 Medium
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery8.6 High
- mf-yang openclaw-cnmf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery5.3 Medium
@frontmcp/adaptersnpmFrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller5.9 Medium- cloudreveCloudreve before 4.17.0 SSRF via Admin.Read OAuth scope5.3 Medium
org.openidentityplatform.opendj:opendj-dsml-servletMavenOpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway9.4 Critical- budibaseBudibase: SSRF via bare fetch() in uploadUrl during AI table generation4.9 Medium
- budibaseBudibase: SSRF via DNS rebinding in the REST datasource integration8.5 High
- budibase serverBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST8.4 High
- microsoft purview data governanceData Quality Elevation of Privilege Vulnerability10.0 Critical
- red hat openshift update service, quay 3 +1 moreQuay: ssrf in red hat quay notification webhooks (slack/generic)5.5 Medium
- snowflake libsnowflakeclient, odbc driver, php pdo driver +2 moreMultiple Security Vulnerabilities in Snowflake libsnowflakeclient8.8 High
- microsoft azure ai searchAzure AI Search Elevation of Privilege Vulnerability8.5 High
- decolua 9router9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch8.3 High
- johnson controls ccure 9000 and victor application serverCCure and Victor Application Server - Server Side Request Forgery7.2 High
- phpoffice phpspreadsheetPhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist7.7 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- complianzWordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- crocoblock jetbookingWordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- ronald huereca photo blockWordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension9.8 Critical
- regularlabs.com articles anywhere pro extension for joomla, users anywhere pro extension for joomla +1 moreJoomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions7.5 High
- n8nn8n before 1.123.67 Arbitrary File Read via Send Email Node8.2 High
- n8nn8n before 2.32.1 SSRF Protection Bypass via MCP Client6.4 Medium
- progress telerik ui for asp.net ajaxRadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX6.5 Medium
- n8nn8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters6.3 Medium
- gitea open source git serverSSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata7.5 High
- giteaGitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass8.3 High
- verint verbaVerba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader9.2 Critical
- verint verbaVerba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass9.2 Critical
- gitea open source git serverTwo SSRF findings in Gitea 1.26.27.7 High
- keephq keepKeep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck9.2 Critical
- mzxrai mcp-webresearchmcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering8.3 High
- gitea open source git serverRepository migration SSRF via multi-answer DNS allow-list bypass6.5 Medium
- gitea open source git serverSSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL6.3 Medium
- internlm lmdeployLMDeploy Server-Side Request Forgery via HTTP Redirect Bypass7.7 High
- gitea open source git serverBlind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim3.1 Low
- gitea open source git serverRepository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration8.5 High
- red hat mirror registry for red hat openshift 2, quay 3.10, quay 3.12 +5 more +7 moreQuay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation6.8 Medium
- axiosaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.06.9 Medium
- wwbn avideoAVideo Encoder downloadURL SSRF via unpinned retry fallback5.3 Medium
- huginnHuginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method6.3 Medium
- hyperdxio hyperdxHyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint6.3 Medium
- Show moreLoading…