# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.](https://agentprime.io/advisories/CVE-2025-45872.md)
  `CVE-2025-45872` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Akamai CloudTest](https://agentprime.io/advisories/CVE-2025-52491.md)
  `CVE-2025-52491` · CVE record: Akamai CloudTest · CVSS 5.8 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [MobSF vulnerability allows SSRF due to the allow_redirects=True parameter](https://agentprime.io/advisories/GHSA-m435-9v6r-v5f6.md)
  `GHSA-m435-9v6r-v5f6`, `CVE-2024-54000`, `PYSEC-2024-256` · PyPI `mobsf`: affected `<3.9.7`, fixed in `3.9.7` · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs](https://agentprime.io/advisories/CVE-2025-53018.md)
  `CVE-2025-53018` · CVE record: LycheeOrg Lychee · CVSS 3.0 Low · Not analysed yet · Published 27 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [diyhi bbs HTTP Header login getUrl server-side request forgery](https://agentprime.io/advisories/CVE-2025-6762.md)
  `CVE-2025-6762` · CVE record: diyhi bbs · CVSS 5.3 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-2940.md)
  `CVE-2025-2940` · CVE record: techjewel Ninja Tables – Easy Data Table Builder · CVSS 7.2 High · Not analysed yet · Published 27 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens](https://agentprime.io/advisories/GHSA-h3qp-hwvr-9xcq.md)
  `GHSA-h3qp-hwvr-9xcq`, `CVE-2025-52477`, `GO-2025-3779` · Go `github.com/octo-sts/app`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 8.6 High · Not analysed yet · Published 26 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, In…](https://agentprime.io/advisories/CVE-2024-51981.md)
  `CVE-2024-51981` · CVE record: Brother Industries, Ltd HL-L8260CDN and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Other injection, Server-side request forgery (SSRF)
- [Unauthenticated Server Side Request Forgery (SSRF) via WS-Addressing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.](https://agentprime.io/advisories/CVE-2024-51980.md)
  `CVE-2024-51980` · CVE record: Brother Industries, Ltd HL-L8260CDN and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises](https://agentprime.io/advisories/CVE-2025-49852.md)
  `CVE-2025-49852` · CVE record: ControlID iDSecure On-premises · CVSS 8.7 High · Not analysed yet · Published 24 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.Reque...](https://agentprime.io/advisories/GHSA-h5gc-rm8j-5gpr.md)
  `GHSA-h5gc-rm8j-5gpr`, `CVE-2025-2828`, `PYSEC-2025-70` · PyPI `langchain-community`: affected `<0.0.28`, fixed in `0.0.28` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 23 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery](https://agentprime.io/advisories/CVE-2025-6517.md)
  `CVE-2025-6517` · CVE record: Dromara MaxKey · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.](https://agentprime.io/advisories/GHSA-wxj7-3fx5-pp9m.md)
  `GHSA-wxj7-3fx5-pp9m`, `BIT-mlflow-2025-52967`, `CVE-2025-52967`, `PYSEC-2025-52` · PyPI `mlflow`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 5.8 Medium · Not analysed yet · Published 23 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Selea Targa IP OCR-ANPR Camera Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-34021.md)
  `CVE-2025-34021` · CVE record: Selea Targa IP OCR-ANPR Camera · CVSS 7.8 High · Not analysed yet · Published 20 Jun 2025 · Tags: Server-side request forgery (SSRF), CWE-20
- [WordPress WPThumb plugin <= 0.10 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49983.md)
  `CVE-2025-49983` · CVE record: Joe Hoyle WPThumb · CVSS 4.9 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress PowerPress Podcasting plugin <= 11.13.11 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49984.md)
  `CVE-2025-49984` · CVE record: blubrry PowerPress Podcasting · CVSS 4.9 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Auto Upload Images plugin <= 3.3.2 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49985.md)
  `CVE-2025-49985` · CVE record: Ali Irani Auto Upload Images · CVSS 4.9 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-52713.md)
  `CVE-2025-52713` · CVE record: BoldGrid Post and Page Builder by BoldGrid · CVSS 6.4 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [PowSyBl Core XML Reader allows XXE and SSRF](https://agentprime.io/advisories/GHSA-qpj9-qcwx-8jv2.md)
  `GHSA-qpj9-qcwx-8jv2`, `CVE-2025-47293` · Maven `com.powsybl:powsybl-commons`: affected `<6.7.2`, fixed in `6.7.2` · CVSS 2.7 Low · Not analysed yet · Published 19 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [Server-side request forgery in Versa Director](https://agentprime.io/advisories/CVE-2025-23172.md)
  `CVE-2025-23172` · CVE record: Versa Director · CVSS 7.2 High · Not analysed yet · Published 18 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-30680.md)
  `CVE-2025-30680` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-30679.md)
  `CVE-2025-30679` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-30678.md)
  `CVE-2025-30678` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49877.md)
  `CVE-2025-49877` · CVE record: Metagauss ProfileGrid · CVSS 4.9 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Intera InHire server-side request forgery](https://agentprime.io/advisories/CVE-2025-6142.md)
  `CVE-2025-6142` · CVE record: Intera InHire · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-49190.md)
  `CVE-2025-49190` · CVE record: SICK AG SICK Field Analytics · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx](https://agentprime.io/advisories/GHSA-68cf-j696-wvv9.md)
  `GHSA-68cf-j696-wvv9` · Maven `org.geoserver:gs-wfs`: affected `>=1.0.0, <2.24.4 || >=2.25.0, <2.25.2`, fixed in `2.24.4`, `2.25.2` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint](https://agentprime.io/advisories/GHSA-2p76-gc46-5fvc.md)
  `GHSA-2p76-gc46-5fvc` · Maven `org.geonetwork-opensource:gn-web-app` and 1 more: affected `>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13`, fixed in `4.4.8`, `4.2.13` · CVSS 8.2 High · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [\[XBOW-025-068\] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://agentprime.io/advisories/GHSA-jj54-8f66-c5pc.md)
  `GHSA-jj54-8f66-c5pc`, `CVE-2025-30220` · Maven `org.geoserver:gs-wfs` and 1 more: affected `>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7`, fixed in `2.27.1`, `2.26.3`, `2.25.7` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.44 · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [Server-side request forgery in Fortinet FortiClientEMS](https://agentprime.io/advisories/CVE-2023-48786.md)
  `CVE-2023-48786` · CVE record: Fortinet FortiClientEMS · CVSS 4.1 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Coverage REST API Server Side Request Forgery](https://agentprime.io/advisories/GHSA-r4hf-r8gj-jgw2.md)
  `GHSA-r4hf-r8gj-jgw2`, `CVE-2024-40625` · Maven `org.geoserver:gs-rest` and 1 more: affected `<2.26.0`, fixed in `2.26.0` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)](https://agentprime.io/advisories/GHSA-mc43-4fqr-c965.md)
  `GHSA-mc43-4fqr-c965`, `CVE-2024-34711` · Maven `org.geoserver.main:gs-main` and 1 more: affected `<2.25.0`, fixed in `2.25.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure, XML external entities (XXE), Server-side request forgery (SSRF), CWE-20
- [GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost](https://agentprime.io/advisories/GHSA-5gw5-jccf-6hxw.md)
  `GHSA-5gw5-jccf-6hxw`, `CVE-2024-29198` · Maven `org.geoserver:gs-wfs` and 1 more: affected `>=2.0.0, <2.24.4 || >=2.25.0, <2.25.2`, fixed in `2.24.4`, `2.25.2` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability](https://agentprime.io/advisories/GHSA-vgq5-3255-v292.md)
  `GHSA-vgq5-3255-v292`, `BIT-kafka-2025-27817`, `CVE-2025-27817` · Maven `org.apache.kafka:kafka-clients`: affected `>=3.1.0, <3.9.1`, fixed in `3.9.1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform](https://agentprime.io/advisories/CVE-2025-42988.md)
  `CVE-2025-42988` · CVE record: SAP_SE SAP Business Objects Business Intelligence Platform · CVSS 3.7 Low · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyoti_SearchEngine_Web_Common/SearchService…](https://agentprime.io/advisories/CVE-2025-44043.md)
  `CVE-2025-44043` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress SocialMark plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-29008.md)
  `CVE-2025-29008` · CVE record: ShawonPro SocialMark · CVSS 4.9 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-30976.md)
  `CVE-2025-30976` · CVE record: wpdive Nexa Blocks · CVSS 4.9 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Car Repair Services theme <= 5.0 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-30997.md)
  `CVE-2025-30997` · CVE record: SmartDataSoft Car Repair Services · CVSS 5.4 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Privilege escalation via SSRF when using HTTP auth](https://agentprime.io/advisories/CVE-2025-46341.md)
  `CVE-2025-46341` · CVE record: FreshRSS FreshRSS · CVSS 7.1 High · Not analysed yet · Published 4 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Acronis Cyber Protect 16](https://agentprime.io/advisories/CVE-2025-48962.md)
  `CVE-2025-48962` · CVE record: Acronis Acronis Cyber Protect 16 · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [quequnlong shiyi-blog optimize server-side request forgery](https://agentprime.io/advisories/CVE-2025-5510.md)
  `CVE-2025-5510` · CVE record: quequnlong shiyi-blog · CVSS 5.3 Medium · Not analysed yet · Published 3 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services](https://agentprime.io/advisories/CVE-2024-7073.md)
  `CVE-2024-7073` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Hewlett Packard Enterprise (HPE) HPE StoreOnce Software](https://agentprime.io/advisories/CVE-2025-37090.md)
  `CVE-2025-37090` · CVE record: Hewlett Packard Enterprise (HPE) HPE StoreOnce Software · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [chshcms mccms Gf.php index server-side request forgery](https://agentprime.io/advisories/CVE-2025-5327.md)
  `CVE-2025-5327` · CVE record: chshcms mccms · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: Server-side request forgery (SSRF)
- [Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2025-4967.md)
  `CVE-2025-4967` · CVE record: Esri Portal for ArcGIS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: Server-side request forgery (SSRF)
- [Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function](https://agentprime.io/advisories/GHSA-frq9-3hp2-xvxg.md)
  `GHSA-frq9-3hp2-xvxg`, `CVE-2025-5276` · npm `mcp-markdownify-server`: affected `<=0.0.1`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 29 May 2025 · Tags: Server-side request forgery (SSRF)
- [maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.](https://agentprime.io/advisories/CVE-2025-45474.md)
  `CVE-2025-45474` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 May 2025 · Tags: Server-side request forgery (SSRF)
- [Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking](https://agentprime.io/advisories/GHSA-wjrh-hj83-3wh7.md)
  `GHSA-wjrh-hj83-3wh7`, `CVE-2025-48383`, `PYSEC-2026-1300` · PyPI `django-select2`: affected `<8.4.1`, fixed in `8.4.1` · CVSS 8.2 High · Not analysed yet · Published 27 May 2025 · Tags: Server-side request forgery (SSRF), CWE-402
- [Strapi allows Server-Side Request Forgery in Webhook function](https://agentprime.io/advisories/GHSA-v8wj-f5c7-pvxf.md)
  `GHSA-v8wj-f5c7-pvxf`, `CVE-2024-52588` · npm `@strapi/admin`: affected `<4.25.2`, fixed in `4.25.2` · CVSS 4.9 Medium · Not analysed yet · Published 27 May 2025 · Tags: Server-side request forgery (SSRF)
- [maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.](https://agentprime.io/advisories/CVE-2025-45475.md)
  `CVE-2025-45475` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 27 May 2025 · Tags: Server-side request forgery (SSRF)
- [thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery](https://agentprime.io/advisories/CVE-2025-5186.md)
  `CVE-2025-5186` · CVE record: thinkgem JeeSite · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2025 · Tags: Server-side request forgery (SSRF)
- [Seeyon Zhiyuan OA Web Application System ThirdMenuController.class this.oursNetService.getData server-side request forgery](https://agentprime.io/advisories/CVE-2025-5140.md)
  `CVE-2025-5140` · CVE record: Seeyon Zhiyuan OA Web Application System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in StrangeBee TheHive](https://agentprime.io/advisories/CVE-2025-48739.md)
  `CVE-2025-48739` · CVE record: StrangeBee TheHive · CVSS 4.6 Medium · Not analysed yet · Published 23 May 2025 · Tags: Server-side request forgery (SSRF)
- [SSRF Server Side Request Forgery](https://agentprime.io/advisories/CVE-2024-13957.md)
  `CVE-2024-13957` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 7.0 High · Not analysed yet · Published 22 May 2025 · Tags: Server-side request forgery (SSRF)
- [TYPO3 CMS Webhooks Server Side Request Forgery](https://agentprime.io/advisories/GHSA-p4xx-m758-3hpx.md)
  `GHSA-p4xx-m758-3hpx`, `CVE-2025-47936`, `PKSA-q52p-kj6f-r4yz` · Packagist `typo3/cms-webhooks`: affected `>=12.0.0, <12.4.31 || >=13.0.0, <13.4.12`, fixed in `12.4.31`, `13.4.12` · CVSS 3.3 Low · Not analysed yet · Published 20 May 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in appleple inc. a-blog cms](https://agentprime.io/advisories/CVE-2025-36560.md)
  `CVE-2025-36560` · CVE record: appleple inc. a-blog cms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2025 · Tags: Server-side request forgery (SSRF)
- [Nextcloud Server's test remote endpoint is not rate limited](https://agentprime.io/advisories/CVE-2025-47791.md)
  `CVE-2025-47791` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 May 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2025-40595.md)
  `CVE-2025-40595` · CVE record: SonicWall SMA1000 · CVSS 7.2 High · Not analysed yet · Published 14 May 2025 · Tags: Server-side request forgery (SSRF)
- [Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook](https://agentprime.io/advisories/CVE-2024-13940.md)
  `CVE-2024-13940` · CVE record: Ninja Forms Ninja Forms Webhooks · CVSS 5.5 Medium · Not analysed yet · Published 14 May 2025 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI1LTA1LTE0VDA4OjIyOjA4LjQxMzAwMFoiLCJDVkUtMjAyNC0xMzk0MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI1LTA3LTAxVDE0OjQ0OjIyLjkxMzAwMFoiLCJDVkUtMjAyNS0zNDA1MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI1LTA3LTAxVDE0OjQ0OjIyLjkxMzAwMFoiLCJDVkUtMjAyNS0zNDA1MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.