CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedJeecgBoot Anonymous Chat Attachment send server-side request forgery6.9 Medium
- heshengtao super-agent-partyheshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery6.9 Medium
- mervinpraison praisonaiPraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)7.5 High
- mervinpraison praisonaiPraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets7.7 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by server-side request forgery in provider validation and API request functionality7.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by server-side request forgery in provider validation and API request functionality6.5 Medium
- ibm application gateway operatorServer-Side Request Forgery (SSRF) in IBM Application Gateway Operator8.5 High
- electronElectron: HTTP redirect followed into local file loader5.9 Medium
- progress marklogic serverServer-side request forgery in Progress MarkLogic Server8.5 High
- tryghost ghostGhost: Server-Side Request Forgery Mitigation Issue4.0 Medium
- go-shiori shiorigo-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch8.5 High
- usememos memosMemos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass8.5 High
- stirling-tools stirling-pdfStirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess8.6 High
- firefly-iiiFirefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding4.3 Medium
- pixelfedPixelfed - Authenticated SSRF via Remote URL Search4.3 Medium
- paperless-ngxPaperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host6.5 Medium
- mlflowmlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint7.1 High
- kubesphereKubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation6.5 Medium
- poesis rhymix cmsPoesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery5.1 Medium
- tryghost ghostGhost: Server-Side Request Forgery in Image Fetching4.1 Medium
- odysseus-dev odysseusOdysseus SSRF via Embedding Endpoint Configuration6.1 Medium
- cjcollier google::authGoogle::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: DNS Rebinding SSRF Bypass6.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering4.1 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader7.7 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an...7.5 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an...7.5 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an...7.5 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request...7.5 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request...7.5 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation...7.5 High
- nousresearch hermes-agentNousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery5.3 Medium
- flowiseai flowiseFlowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses7.6 High
- djangoproject djangoServer-side file-write and request forgery via spatial lookups8.7 High
- fast-urifast-uri vulnerable to server-side request forgery via malformed IPv6 normalization7.5 High
- fast-urifast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding7.5 High
- microsoft stunnel, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreStunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services5.4 Medium
- themeisle visualizerVisualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import6.8 Medium
- unknown embedpressEmbedPress < 4.6.1 - Unauthenticated Blind SSRF5.8 Medium
- unknown simple google calendar outlook events widgetSimple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.1 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)10.0 Critical
- guzzleGuzzle: Noncanonical host can bypass host-based checks7.2 High
- foxit readerjina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery6.9 Medium
- shlinkio shlinkShlink Server-Side Request Forgery via Short URL Title Auto-Resolution5.3 Medium
- beaugunderson ip-addressip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks6.9 Medium
- beaugunderson ip-addressip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass7.7 High
- misp cti-transmuteServer-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering8.8 High
- Show moreLoading…