CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- instantsoft icms2InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning3.1 Low
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Information Disclosure Vulnerability3.5 Low
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability8.2 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Information Disclosure Vulnerability6.5 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability6.5 Medium
- grokability snipe-itsnipe-it before 8.7.0 SSRF via IPv6 transition address bypass5.9 Medium
- xenforoXenForo < 2.3.13 SSRF via PayPal REST Webhook Handler7.7 High
- eclipse foundation che, the eclipse foundation eclipse che +1 moreIn Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data...6.3 Medium
- john darrel hide my wp ghostWordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- sap se manufacturing integration and intelligenceServer-Side Request Forgery in SAP Manufacturing Integration and Intelligence6.5 Medium
- knowns-dev knownsknowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint6.9 Medium
- ash-project ash authentication oauth2 serverash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF6.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via...3.3 Low
- java-json-tools jackson-coreutilsjava-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery6.9 Medium
- mispMISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery7.0 High
- projeto-siga sigaprojeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery6.9 Medium
- liufee feehicmsliufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery5.1 Medium
- openagents-org openagentsopenagents-org openagents http.py test_default_model server-side request forgery6.9 Medium
- thu-maic openmaicOpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation9.0 Critical
- mindsdbMindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler8.7 High
- sqlchatSQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints9.4 Critical
- rowboatlabs rowboatRowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server5.3 Medium
- webstudio-is webstudioWebstudio through 0.296.0 SSRF via /cgi proxy routes9.2 Critical
- elegant themes diviDivi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter5.0 Medium
- unknown greenshiftGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint4.1 Medium
- owen2345 camaleoncmsCamaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL5.3 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by server-side request forgery due to missing URL validation in flow components5.0 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components5.0 Medium
- ibm contextforge, contextforge mcp gateway (`mcp-contextforge-gateway`) +1 moreIBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation7.7 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components7.7 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components8.6 High
- ibm contextforge, contextforge mcp gateway +1 moreIBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint8.2 High
- foxit readerjina-ai reader server-side request forgery via redirect validation bypass8.7 High
- ccfos nightingaleNightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding7.1 High
- the-vibe-company megaparseMegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url8.7 High
- modelscope ms-swiftms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs8.7 High
- camel-ai owlOWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching8.7 High
- hiyouga llamafactoryLLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding8.7 High
- ogx-ai ogxogx 1.3.1 Server-Side Request Forgery via MCP tool server_url8.7 High
- marqo-ai marqoMarqo 2.26.0 Server-Side Request Forgery via Media URLs6.9 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel5.3 Medium
- evil0ctal douyin tiktok download apiDouyin_TikTok_Download_API 4.1.2 SSRF via url parameter8.7 High
- openpanel-dev openpanelOpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker9.2 Critical
- openpanel-dev openpanelOpenPanel before 2.3.0 SSRF via favicon and og endpoints8.7 High
- openpanel-dev openpanelOpenpanel before 2.3.0 SSRF via Site Checker Endpoint6.9 Medium
- snowflake jdbc driver, jdbc driver (fips), jdbc driver (thin) +2 moreSnowflake JDBC Driver auto-configuration account validation permits credential redirection5.3 Medium
- apache software foundation alluraApache Allura: Server-side request forgery9.1 Critical
- asus control center enterprise (acc)Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard...10.0 Critical
- light0011 cmslight0011 cms UEditor controller.php catchimage server-side request forgery6.9 Medium
- microsoft power platformPower Automate Elevation of Privilege Vulnerability8.5 High
- Show moreLoading…