CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms server-side request forgery7.5 High
- openclaw windows nodeOpenClaw Windows Node through 2026.9.4 SSRF via canvas.present5.3 Medium
- quenary tugtainerTugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint9.1 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF...4.3 Medium
- modeltc lightllmLightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints6.9 Medium
- @astrojs netlify, withastro astro +1 moreAstro: Netlify Image CDN allowlist bypass enables SSRF6.3 Medium
- moodleMoodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass4.3 Medium
- apos37 broken link notifierBroken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass5.8 Medium
- jupyterlabJupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs5.4 Medium
- claraverse-space claraverseClaraVerse through 0.3.1 SSRF Protection Bypass5.3 Medium
- getfider fiderFider before 0.38.0 SSRF via DNS rebinding in webhook validation2.1 Low
- anjvision yssd-rtmp-h5Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H56.9 Medium
- hewlett packard enterprise (hpe) instant onAuthenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs7.2 High
- eclipse foundation threadx netx duoThe FTP client trusts arbitrary IP addresses in the PASV server response6.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.38.9 High
- modsetter surfsenseMODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery5.3 Medium
- jpadilla pyjwtPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 High
- stringer-rss stringerAuthenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer7.6 High
- beaugunderson ip-addressip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts6.3 Medium
- beaugunderson ip-addressip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass6.9 Medium
- axiosAxios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls7.0 High
- leshchenko1979 fast-mcp-telegramSSRF via DNS-resolution gap in _validate_url_security (file download by URL)7.1 High
- apache software foundation rollerApache Roller: Server-side request forgery via entry trackback and enclosure URLs7.4 High
- regularlabs modules anywhere, regularlabs.com modules anywhere (pro) extension for joomla +1 moreJoomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla8.5 High
- No product listedOctober CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery6.9 Medium
- athlon1600 youtube-downloaderathlon1600 youtube-downloader stream.php stream server-side request forgery6.9 Medium
- devaslanphp project-managementDevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery5.1 Medium
- privoce vocechat serverPrivoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery6.9 Medium
- nezhahq nezhaNezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv65.3 Medium
- universal-tool-calling-protocol python-utcputcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass2.3 Low
- universal-tool-calling-protocol python-utcppython-utcp before 1.1.4 SSRF via unvalidated HTTP redirects8.4 High
- universal-tool-calling-protocol python-utcputcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass7.1 High
- universal-tool-calling-protocol python-utcppython-utcp before 1.1.12 SSRF via Remote HTTP Manual7.1 High
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview4.1 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run4.1 Medium
- heymrun heymHeym before 0.0.91 SSRF via image fetching and IPv6 validation5.3 Medium
- heymrun heymheym before 0.0.105 SSRF via credential-controlled base URLs5.3 Medium
- heymrun heymHeym before 0.0.106 Credential Exfiltration via URL Override7.1 High
- heymrun heymheym before 0.0.109 Server-Side Request Forgery via Workflow Nodes7.6 High
- azuracastAzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist4.8 Medium
- azuracastAzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs7.1 High
- azuracastAzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL7.1 High
- kyvernoKyverno before 1.19.1 SSRF via legacy apiCall service executor8.3 High
- vrana adminerAdminer before 6.0.2 Privileged-Port SSRF via host_port Regex6.9 Medium
- vrana adminerAdminer 6.0.0 Server-Side Request Forgery via ClickHouse driver5.3 Medium
- vrana adminerAdminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver6.9 Medium
- budibase serverBudibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook6.3 Medium
- openclaw clawhubClawHub SSRF via Unchecked DNS Resolution in Profile Image6.9 Medium
- Show moreLoading…