CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.06.3 Medium
- progress software @progress/sitefinity-nextjs-sdkCWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK8.8 High
- the document foundation libreofficeLFI and GET SSRF via GStreamer and HLS playlists6.7 Medium
- the document foundation libreofficeLFI and GET SSRF via calcext:data-mappings and csv provider6.7 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery6.9 Medium
- shaarliShaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery5.1 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery6.9 Medium
- No product listedFeehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor...7.5 High
- zitadelZitadel before 4.16.2 SSRF via Organization Domain HTTP Verification2.3 Low
- sciphi-ai r2rSciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery6.9 Medium
- openidentityplatform openamOpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri5.3 Medium
- hkuds vibe-tradingHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool8.7 High
- triggerdotdev trigger.devTrigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL5.3 Medium
- utmstackUTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf6.3 Medium
- utmstackUTMStack < 11.2.16 SSRF via IdentityProviderService5.3 Medium
- aws loomServer-side request forgery in the tool server and remote agent connection handling in Loom for AWS8.3 High
- aws loomServer-side request forgery in the OAuth2 discovery handling in Loom for AWS8.2 High
- weaver e-bridgeWeaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile8.7 High
rmcpcrates.iormcp OAuth client fetches server-controlled resource_metadata URLs6.3 Medium- vercel next.jsNext.js: Server-Side Request Forgery in Image Optimization8.3 High
- themerex addonsWordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- yeswikiYesWiki before 4.6.7 Stored XSS via Bazar valeur Action5.1 Medium
- yeswikiYesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter5.3 Medium
- yeswikiYesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter8.8 High
- yeswikiYesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox8.3 High
- yeswikiYesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle6.9 Medium
- yeswikiYesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses8.3 High
- yeswikiYesWiki before 4.6.7 Unauthenticated SSRF via syndication Action6.9 Medium
- yeswikiYesWiki before 4.6.7 Unauthenticated SSRF via valeur Action6.9 Medium
- yeswikiYesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter6.9 Medium
- havelsan inc. sef - ai chatbot platformAPI Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform4.9 Medium
- modelcontextprotocol mcp-server-everything, mcp-server-fetch +1 moremodelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery6.9 Medium
- wormholeWormhole.app SSRF6.9 Medium
- getsimplecms-ceGetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint7.5 High
- getsimplecms-ceGetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction9.1 Critical
- givanz vvvebVvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy7.6 High
- budibaseBudibase before 3.41.0 SSRF via uploadUrl in AI Table Generation8.3 High
- tryghost ghostGhost 3.20.2 before 6.51.0 SSRF via image-size fetch5.3 Medium
- tryghost ghostGhost: Server-Side Request Forgery in Webhook Trigger2.7 Low
- tryghost ghostGhost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook5.1 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration5.5 Medium
- formtools.org form toolsformtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery5.3 Medium
- decolua 9routerdecolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery6.9 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- idocviewiDocView SSRF via /doc/upload Endpoint Hardcoded Token8.7 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Server-Side Request Forgery (SSRF)3.3 Low
- Show moreLoading…