# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.](https://agentprime.io/advisories/CVE-2025-45887.md) `CVE-2025-45887` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2025 · Tags: Server-side request forgery (SSRF) - [Microsoft Power Apps Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-47733.md) `CVE-2025-47733` · CVE record: Microsoft Microsoft Power Pages · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2025 · Tags: Server-side request forgery (SSRF) - [Azure Storage Resource Provider Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2025-29972.md) `CVE-2025-29972` · CVE record: Microsoft Azure Storage Resource Provider (SRP) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47664.md) `CVE-2025-47664` · CVE record: ThimPress WP Pipes · CVSS 4.4 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47635.md) `CVE-2025-47635` · CVE record: WPWebinarSystem WebinarPress · CVSS 5.5 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin <= 1.4.4 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47548.md) `CVE-2025-47548` · CVE record: Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress · CVSS 5.4 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47484.md) `CVE-2025-47484` · CVE record: Oliver Campion Display Remote Posts Block · CVSS 6.4 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Easy Replace Image plugin <= 3.5.0 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47483.md) `CVE-2025-47483` · CVE record: Iulia Cazan Easy Replace Image · CVSS 4.9 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-47464.md) `CVE-2025-47464` · CVE record: solacewp Solace Extra · CVSS 4.9 Medium · Not analysed yet · Published 7 May 2025 · Tags: Server-side request forgery (SSRF) - [MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.](https://agentprime.io/advisories/CVE-2025-45250.md) `CVE-2025-45250` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 6 May 2025 · Tags: Server-side request forgery (SSRF) - [IBM Concert Software server-side request forgery](https://agentprime.io/advisories/CVE-2024-55910.md) `CVE-2024-55910` · CVE record: IBM Concert Software · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2025 · Tags: Server-side request forgery (SSRF) - [Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability](https://agentprime.io/advisories/CVE-2025-46568.md) `CVE-2025-46568` · CVE record: Stirling-Tools Stirling-PDF · CVSS 7.7 High · Not analysed yet · Published 1 May 2025 · Tags: Server-side request forgery (SSRF) - [Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook](https://agentprime.io/advisories/CVE-2024-13845.md) `CVE-2024-13845` · CVE record: Gravity Forms Gravity Forms WebHooks · CVSS 5.5 Medium · Not analysed yet · Published 1 May 2025 · Tags: Server-side request forgery (SSRF) - [Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.](https://agentprime.io/advisories/CVE-2024-48907.md) `CVE-2024-48907` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 May 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2025-2170.md) `CVE-2025-2170` · CVE record: SonicWall SMA1000 · CVSS 7.2 High · Not analysed yet · Published 30 Apr 2025 · Tags: Server-side request forgery (SSRF) - [playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery](https://agentprime.io/advisories/CVE-2025-4012.md) `CVE-2025-4012` · CVE record: playeduxyz PlayEdu 开源培训系统 · CVSS 5.1 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in DevExpress](https://agentprime.io/advisories/CVE-2023-35817.md) `CVE-2023-35817` · CVE record: DevExpress DevExpress · CVSS 5.0 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: Server-side request forgery (SSRF) - [ChurchCRM Referer server-side request forgery](https://agentprime.io/advisories/CVE-2025-3954.md) `CVE-2025-3954` · CVE record: ChurchCRM · CVSS 6.3 Medium · Not analysed yet · Published 26 Apr 2025 · Tags: Server-side request forgery (SSRF) - [ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter](https://agentprime.io/advisories/CVE-2025-3775.md) `CVE-2025-3775` · CVE record: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin · CVSS 6.5 Medium · Not analysed yet · Published 25 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-46531.md) `CVE-2025-46531` · CVE record: Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) · CVSS 4.9 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-46511.md) `CVE-2025-46511` · CVE record: Derek Springer BeerXML Shortcode · CVSS 6.4 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Simple Google Photos Grid plugin <= 1.5 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-46503.md) `CVE-2025-46503` · CVE record: josheli Simple Google Photos Grid · CVSS 4.9 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-46443.md) `CVE-2025-46443` · CVE record: Adam Pery Animate · CVSS 4.9 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Server-side request forgery (SSRF) - [PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-1522.md) `CVE-2025-1522` · CVE record: PostHog PostHog · CVSS 7.1 High · Not analysed yet · Published 23 Apr 2025 · Tags: Server-side request forgery (SSRF) - [PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-1521.md) `CVE-2025-1521` · CVE record: PostHog PostHog · CVSS 7.1 High · Not analysed yet · Published 23 Apr 2025 · Tags: Server-side request forgery (SSRF) - [IBM WebSphere Application Server server-side request forgery](https://agentprime.io/advisories/CVE-2025-27907.md) `CVE-2025-27907` · CVE record: IBM WebSphere Application Server · CVSS 4.1 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Server-side request forgery (SSRF) - [IBM Maximo Asset Management server-side request forgery](https://agentprime.io/advisories/CVE-2025-2987.md) `CVE-2025-2987` · CVE record: IBM Maximo Asset Management · CVSS 3.8 Low · Not analysed yet · Published 21 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Crawl4AI SSRF vulnerability](https://agentprime.io/advisories/GHSA-445m-27cf-gr3x.md) `GHSA-445m-27cf-gr3x`, `CVE-2025-28197`, `PYSEC-2026-1281` · PyPI `crawl4ai`: affected `<=0.4.247`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Apr 2025 · Tags: Server-side request forgery (SSRF) - [PbootCMS Image server-side request forgery](https://agentprime.io/advisories/CVE-2025-3787.md) `CVE-2025-3787` · CVE record: PbootCMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.](https://agentprime.io/advisories/CVE-2025-29461.md) `CVE-2025-29461` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function.](https://agentprime.io/advisories/CVE-2025-29460.md) `CVE-2025-29460` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function.](https://agentprime.io/advisories/CVE-2025-29459.md) `CVE-2025-29459` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function.](https://agentprime.io/advisories/CVE-2025-29458.md) `CVE-2025-29458` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.](https://agentprime.io/advisories/CVE-2025-29457.md) `CVE-2025-29457` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function.](https://agentprime.io/advisories/CVE-2025-29456.md) `CVE-2025-29456` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" function.](https://agentprime.io/advisories/CVE-2025-29455.md) `CVE-2025-29455` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.](https://agentprime.io/advisories/CVE-2025-29454.md) `CVE-2025-29454` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings component.](https://agentprime.io/advisories/CVE-2025-29453.md) `CVE-2025-29453` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component.](https://agentprime.io/advisories/CVE-2025-29452.md) `CVE-2025-29452` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component.](https://agentprime.io/advisories/CVE-2025-29451.md) `CVE-2025-29451` · CVE record · CVSS 7.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component.](https://agentprime.io/advisories/CVE-2025-29450.md) `CVE-2025-29450` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function.](https://agentprime.io/advisories/CVE-2025-29449.md) `CVE-2025-29449` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss](https://agentprime.io/advisories/CVE-2024-56736.md) `CVE-2024-56736` · CVE record: Apache Software Foundation Apache HertzBeat · CVSS 6.5 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Server-side request forgery (SSRF) - [mirweiye Seven Bears Library CMS Add Link server-side request forgery](https://agentprime.io/advisories/CVE-2025-3691.md) `CVE-2025-3691` · CVE record: mirweiye Seven Bears Library CMS · CVSS 5.1 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Kyverno vulnerable to SSRF via Service Calls](https://agentprime.io/advisories/GHSA-459x-q9hg-4gpq.md) `GHSA-459x-q9hg-4gpq`, `BIT-kyverno-2025-15613`, `CVE-2025-15613`, `GO-2025-3615` · Go `github.com/kyverno/kyverno`: affected `<=1.13.4`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-30964.md) `CVE-2025-30964` · CVE record: ThemeGoods Photography · CVSS 5.4 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-26990.md) `CVE-2025-26990` · CVE record: WP Royal Royal Elementor Addons · CVSS 4.4 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in CrushFTP](https://agentprime.io/advisories/CVE-2025-32102.md) `CVE-2025-32102` · CVE record: CrushFTP CrushFTP · CVSS 5.0 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: Server-side request forgery (SSRF) - [AutoGPT allows SSRF due to DNS Rebinding in requests wrapper](https://agentprime.io/advisories/CVE-2025-31490.md) `CVE-2025-31490` · CVE record: Significant-Gravitas AutoGPT · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2025 · Tags: Server-side request forgery (SSRF) - [INTUMIT SmartRobot - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-3572.md) `CVE-2025-3572` · CVE record: INTUMIT SmartRobot · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.](https://agentprime.io/advisories/CVE-2025-29720.md) `CVE-2025-29720` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Server-side request forgery (SSRF) - [SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)](https://agentprime.io/advisories/GHSA-5q9x-554g-9jgg.md) `GHSA-5q9x-554g-9jgg`, `CVE-2025-71398` · crates.io `surrealdb`: affected `<2.0.5 || >=2.1.0, <2.1.5 || >=2.2.0, <2.2.2`, fixed in `2.0.5`, `2.1.5`, `2.2.2` · CVSS 5.8 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: Server-side request forgery (SSRF) - [SSRF in CyberAudit-Web videx-legacy-ssl](https://agentprime.io/advisories/CVE-2025-22374.md) `CVE-2025-22374` · CVE record: Videx Inc. CyberAudit-Web · CVSS 6.0 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2025-0539.md) `CVE-2025-0539` · CVE record: Octopus Deploy Octopus Server · CVSS 5.9 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress IndieBlocks plugin <= 0.13.1 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-31009.md) `CVE-2025-31009` · CVE record: Jan Boddez IndieBlocks · CVSS 5.4 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Waymark plugin <= 1.5.2 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-32487.md) `CVE-2025-32487` · CVE record: Joe Waymark · CVSS 4.9 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-32675.md) `CVE-2025-32675` · CVE record: QuantumCloud SEO Help · CVSS 6.8 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-32691.md) `CVE-2025-32691` · CVE record: blubrry PowerPress Podcasting · CVSS 4.9 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-3f7v-qx94-666m.md) `GHSA-3f7v-qx94-666m`, `CVE-2025-32372` · NuGet `DotNetNuke.Core`: affected `<9.13.8`, fixed in `9.13.8` · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [mymagicpower AIAS InferController.java server-side request forgery](https://agentprime.io/advisories/CVE-2025-3412.md) `CVE-2025-3412` · CVE record: mymagicpower AIAS · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .