CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- stoatchatstoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass6.9 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting8.8 High
- No product listedOpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery5.3 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ssrf via build archive_url in quay build api4.2 Medium
- ibm mcp-context-forge, mcp-contextforge-gateway +1 moreContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)6.6 Medium
- budibaseBudibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist7.1 High
- ondata ckan-mcp-serverCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)5.3 Medium
- feedmob fm-mcp-serversfeedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery4.8 Medium
- eyaushev swagger-testcase-mcpeyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery5.3 Medium
- model context protocol mcp-rdf-explorerModel Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery6.9 Medium
- enzovezzaro mcp-dominican-layerEnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery5.3 Medium
- enzovezzaro mcp-dominican-layerEnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery5.3 Medium
- flytohub flyto-coreFlyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()6.3 Medium
- dayuanjiang next-ai-draw-ioNext AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url7.7 High
- jegstudio gutenverse companionWordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- tangiblewp vehica coreWordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability6.0 Medium
- s9y serendipitySerendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses8.4 High
- meeting-room-booking-system mrbs-codeMeeting Room Booking System has server-side request forgery in import functionality8.7 High
- aws opensearchMissing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin8.6 High
- drupal entity share websub, entity share websub project share websub +1 moreEntity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-0975.3 Medium
- microsoft ufoMicrosoft UFO: IPv6 transition address bypass of SSRF guard in URL validation6.9 Medium
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.9.8 Critical
- oscal-compass compliance-trestleTrestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.08.6 High
- circl vulnerability-lookupStored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup5.1 Medium
- prowler-cloud prowlerProwler: Server-Side Request Forgery (SSRF) in Lighthouse Provider7.6 High
- fortinet fortisiemA server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0...3.4 Low
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate6.4 Medium
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL7.1 High
- kestra-io kestraKestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata8.6 High
- baptistearno typebot.ioTypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler5.4 Medium
- kekingcn kkfileviewkkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass5.8 Medium
- coturncoturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE5.8 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability6.5 Medium
- microsoft sharepoint server, sharepoint server subscription edition +1 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability6.5 Medium
- microsoft .net, .net 8.0 runtime, .net 9.0 runtime +4 more +6 more.NET Information Disclosure Vulnerability6.5 Medium
- microsoft powershell, powershell 7.6, microsoft powershell 7.4 +1 more +3 morePowerShell Information Disclosure Vulnerability7.4 High
- apache alluraApache Allura: Server-side request forgery9.1 Critical
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)4.7 Medium
- amir20 dozzleDozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher2.3 Low
- activepiecesActivepieces: Server-side request forgery in MCP tool validation endpoint5.3 Medium
- baptistearno typebot.ioTypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server5.4 Medium
- seaweedfsSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle9.3 Critical
- lookyloo playwrightcaptureServer-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture5.1 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation6.9 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15, openshift container platform 4.16 +6 more +8 moreOpenshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console7.4 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console7.4 High
- pinryPinry Pinry - Server-Side Request Forgery7.5 High
- apioo fusioApioo Fusio - Server-Side Request Forgery6.5 Medium
- Show moreLoading…