CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- seopressWordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- hai zheng / lite speed cache litespeed cacheWordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- lookyloo playwrightcaptureServer-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture6.9 Medium
- fleetdm fleet, suse rancher fleet +1 moreFleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing5.3 Medium
- ollamaOllama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect8.7 High
- humansignal label-studioLabel Studio through 1.23.0 SSRF via Unvalidated Webhook URL8.4 High
- nousresearch hermes-agentNousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery5.3 Medium
- n8nn8n before 2.34.1 SSRF via Request Helper URI Validation Bypass5.3 Medium
- wwbn avideoWWBN AVideo Server-Side Request Forgery via set_api_userImages7.1 High
- wwbn avideoAVideo Server-Side Request Forgery via epg_link parameter7.1 High
- ocs inventory ng ocsreportsMultiple vulnerabilities in Ocsreports for OCS Inventory NG7.1 High
- dell powerprotect data managerDell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request...4.1 Medium
- berriai litellmLiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters6.5 Medium
- openedx openedx-platformOpen edX Platform: SSRF in Studio Video Download Endpoint6.8 Medium
- f5 big-ip, big-iq +1 moreBIG-IP and BIG-IQ Configuration utility vulnerability8.7 High
- wpmu dev broken link checkerWordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability5.5 Medium
- eclipse foundation dittoIn Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without va…5.3 Medium
- axllent mailpitMailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix6.9 Medium
- github enterprise serverServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services7.7 High
- github enterprise serverServer-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token8.2 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 moreA Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...10.0 Critical
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX6.4 Medium
- ohf-voice wyomingWyoming < 1.10.2 SSRF via uri Query Parameter6.9 Medium
- heymrun heymHeym before 0.0.98 SSRF via WebSocket endpoints5.3 Medium
- invoice ninja ninja, invoiceninja invoice ninja +1 moreinvoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery5.3 Medium
- hyperledger-firefly fireflyhyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery6.9 Medium
- ellite wallosWallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)4.3 Medium
- ellite wallosWallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`8.2 High
- ellite wallosWallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings3.5 Low
- smarty-php smartySmarty: SSRF via redirect bypass of trusted_uri using {fetch}6.9 Medium
- ellite wallosWallos: SSRF via OIDC Token/UserInfo URL Configuration8.5 High
- ellite wallosWallos: SSRF via Test Email Notification - unvalidated SMTP host/port8.2 High
- mapsvgWordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- studio-42 elfinderelFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback8.6 High
- sdcb chatssdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery5.3 Medium
- oasdiff oasdiff-actionoasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs8.3 High
- mcphubMCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)7.1 High
- mcphubMCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation7.6 High
- nasa earthdata-searchNASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery6.9 Medium
- nasa earthdata-searchNASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery6.9 Medium
- yaojingang geoflowyaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery5.1 Medium
- apache shiroApache Shiro: Server-side POST request may be steered to an alternate host5.9 Medium
- No product listedPowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery6.9 Medium
- No product listedServer-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803....9.1 Critical
- forgejoForgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery5.3 Medium
- foxit readerjina-ai reader Server-Side Request Forgery via disabled private-address guard8.7 High
- usememos memosMemos through 0.30.0 SSRF via Omitted CGNAT Address Range6.9 Medium
- dadrus heimdallIn MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers...5.8 Medium
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password9.3 Critical
- totalprocessing total processing card payments for woocommerceTotal Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure9.1 Critical
- Show moreLoading…