# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Microsoft SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-53760.md) `CVE-2025-53760` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 7.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 12 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Axis Communications AB AXIS Camera Station Pro and others](https://agentprime.io/advisories/CVE-2025-7622.md) `CVE-2025-7622` · CVE record: Axis Communications AB AXIS Camera Station Pro and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf](https://agentprime.io/advisories/CVE-2025-55161.md) `CVE-2025-55161` · CVE record: Stirling-Tools Stirling-PDF · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf](https://agentprime.io/advisories/CVE-2025-55150.md) `CVE-2025-55150` · CVE record: Stirling-Tools Stirling-PDF · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf](https://agentprime.io/advisories/CVE-2025-55151.md) `CVE-2025-55151` · CVE record: Stirling-Tools Stirling-PDF · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Omnissa Secure Email Gateway (SEG) updates address Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-25235.md) `CVE-2025-25235` · CVE record: Omnissa Secure Email Gateway · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Omnissa Workspace ONE UEM](https://agentprime.io/advisories/CVE-2025-25229.md) `CVE-2025-25229` · CVE record: Omnissa Omnissa Workspace ONE UEM · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource](https://agentprime.io/advisories/GHSA-3c93-92r7-j934.md) `GHSA-3c93-92r7-j934`, `CVE-2025-8341`, `GO-2025-3843` · Go `github.com/grafana/grafana-infinity-datasource`: affected `<1.4.2-0.20250731100004-9c736aa21b3a`, fixed in `1.4.2-0.20250731100004-9c736aa21b3a` · CVSS 5.0 Medium · Not analysed yet · Published 11 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Vinades NukeViet Module index.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-8772.md) `CVE-2025-8772` · CVE record: Vinades NukeViet · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-c6g5-g6r7-q4j6.md) `GHSA-c6g5-g6r7-q4j6`, `CVE-2025-4655` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2025.Q1.0, <2025.Q1.6 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92`, fixed in `2025.Q1.6`, `2024.Q1.16` · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-6v93-frf9-2rp8.md) `GHSA-6v93-frf9-2rp8`, `CVE-2025-4581` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2025.Q1.0, <2025.Q1.5 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92`, fixed in `2025.Q1.5`, `2024.Q1.16` · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Azure OpenAI Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-53767.md) `CVE-2025-53767` · CVE record: Microsoft Azure Open AI · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP req…](https://agentprime.io/advisories/CVE-2025-51058.md) `CVE-2025-51058` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Server-side request forgery (SSRF) - [MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.](https://agentprime.io/advisories/CVE-2025-50234.md) `CVE-2025-50234` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Server-side request forgery (SSRF) - [4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).](https://agentprime.io/advisories/CVE-2024-55399.md) `CVE-2024-55399` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Server-side request forgery (SSRF) - [cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery](https://agentprime.io/advisories/CVE-2025-8529.md) `CVE-2025-8529` · CVE record: cloudfavorites favorites-web · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Exrick xboot Swagger SecurityController.java server-side request forgery](https://agentprime.io/advisories/CVE-2025-8527.md) `CVE-2025-8527` · CVE record: Exrick xboot · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Server-side request forgery (SSRF) - [givanz Vvveb Drag-and-Drop Editor editor server-side request forgery](https://agentprime.io/advisories/CVE-2025-8520.md) `CVE-2025-8520` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch](https://agentprime.io/advisories/CVE-2025-54132.md) `CVE-2025-54132` · CVE record: cursor cursor · CVSS 4.4 Medium · Not analysed yet · Published 1 Aug 2025 · Tags: Server-side request forgery (SSRF) - [GLPI has overly permissive URL verification](https://agentprime.io/advisories/CVE-2025-52567.md) `CVE-2025-52567` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 30 Jul 2025 · Tags: Server-side request forgery (SSRF) - [BentoML SSRF Vulnerability in File Upload Processing](https://agentprime.io/advisories/GHSA-mrmq-3q62-6cc8.md) `GHSA-mrmq-3q62-6cc8`, `CVE-2025-54381`, `PYSEC-2026-297` · PyPI `bentoml`: affected `>=1.4.0, <1.4.19`, fixed in `1.4.19` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 29 Jul 2025 · Tags: Server-side request forgery (SSRF) - [webfinger.js Blind SSRF Vulnerability](https://agentprime.io/advisories/GHSA-8xq3-w9fx-74rv.md) `GHSA-8xq3-w9fx-74rv`, `CVE-2025-54590` · npm `webfinger.js`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in MedDream PACS Premium](https://agentprime.io/advisories/CVE-2025-24485.md) `CVE-2025-24485` · CVE record: MedDream MedDream PACS Premium · CVSS 5.8 Medium · Not analysed yet · Published 28 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/GHSA-c2fv-2fmj-9xrx.md) `GHSA-c2fv-2fmj-9xrx` · npm `ssrfcheck`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 8.2 High · Withdrawn · Not analysed yet · Published 28 Jul 2025 · Tags: Server-side request forgery (SSRF) - [yanyutao0402 ChanCMS getPages server-side request forgery](https://agentprime.io/advisories/CVE-2025-8228.md) `CVE-2025-8228` · CVE record: yanyutao0402 ChanCMS · CVSS 5.3 Medium · Not analysed yet · Published 27 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Salesforce Tableau Server](https://agentprime.io/advisories/CVE-2025-52455.md) `CVE-2025-52455` · CVE record: Salesforce Tableau Server · CVSS 5.3 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Salesforce Tableau Server](https://agentprime.io/advisories/CVE-2025-52454.md) `CVE-2025-52454` · CVE record: Salesforce Tableau Server · CVSS 8.2 High · Not analysed yet · Published 25 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Salesforce Tableau Server](https://agentprime.io/advisories/CVE-2025-52453.md) `CVE-2025-52453` · CVE record: Salesforce Tableau Server · CVSS 8.2 High · Not analysed yet · Published 25 Jul 2025 · Tags: Server-side request forgery (SSRF) - [yanyutao0402 ChanCMS gather.js getArticle server-side request forgery](https://agentprime.io/advisories/CVE-2025-8133.md) `CVE-2025-8133` · CVE record: yanyutao0402 ChanCMS · CVSS 5.3 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.](https://agentprime.io/advisories/CVE-2025-45939.md) `CVE-2025-45939` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: Server-side request forgery (SSRF) - [private-ip vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-9h3q-32c7-r533.md) `GHSA-9h3q-32c7-r533`, `CVE-2025-8020` · npm `private-ip`: affected `<=3.0.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 23 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-5818.md) `CVE-2025-5818` · CVE record: krasenslavov Featured Image Plus – Bulk Edit Featured Images, Unsplash & Alt Text Manager · CVSS 5.5 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint](https://agentprime.io/advisories/CVE-2025-54122.md) `CVE-2025-54122` · CVE record: Manager-io Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior.](https://agentprime.io/advisories/CVE-2025-52362.md) `CVE-2025-52362` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2025 · Tags: Server-side request forgery (SSRF) - [An issue was discovered in Eveo URVE Web Manager 27.02.2025.](https://agentprime.io/advisories/CVE-2025-36845.md) `CVE-2025-36845` · CVE record · CVSS 8.6 High · Not analysed yet · Published 21 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Emby Windows](https://agentprime.io/advisories/CVE-2025-46385.md) `CVE-2025-46385` · CVE record: Emby Windows · CVSS 8.6 High · Not analysed yet · Published 20 Jul 2025 · Tags: Server-side request forgery (SSRF) - [XXL-JOB is vulnerable to SSRF attacks](https://agentprime.io/advisories/GHSA-f8vw-8vgh-22r9.md) `GHSA-f8vw-8vgh-22r9`, `CVE-2025-7787` · Maven `com.xuxueli:xxl-job-core`: affected `<=3.1.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Server-side request forgery (SSRF) - [A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary intern…](https://agentprime.io/advisories/CVE-2025-52163.md) `CVE-2025-52163` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Server-side request forgery (SSRF) - [thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgery](https://agentprime.io/advisories/CVE-2025-7759.md) `CVE-2025-7759` · CVE record: thinkgem JeeSite · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2025-20288.md) `CVE-2025-20288` · CVE record: Cisco Cisco Unified Contact Center Express and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints](https://agentprime.io/advisories/GHSA-f7h5-c625-3795.md) `GHSA-f7h5-c625-3795`, `CVE-2024-9408` · Maven `org.glassfish.main.admingui:console-common`: affected `<=6.2.5`, no fixed version yet · CVSS 8.9 High · Not analysed yet · Published 16 Jul 2025 · Tags: Server-side request forgery (SSRF) - [WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-48294.md) `CVE-2025-48294` · CVE record: Kerfred FG Drupal to WordPress · CVSS 4.4 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Null byte termination in hostnames](https://agentprime.io/advisories/CVE-2025-1220.md) `CVE-2025-1220` · CVE record: PHP Group PHP · CVSS 3.7 Low · Not analysed yet · Published 13 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Postiz allows header mutation in middleware facilitates resulting in SSRF](https://agentprime.io/advisories/CVE-2025-53641.md) `CVE-2025-53641` · CVE record: gitroomhq postiz-app · CVSS 8.2 High · Not analysed yet · Published 11 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Schneider Electric EcoStruxure™ IT Data Center Expert](https://agentprime.io/advisories/CVE-2025-50125.md) `CVE-2025-50125` · CVE record: Schneider Electric EcoStruxure™ IT Data Center Expert · CVSS 6.3 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-6851.md) `CVE-2025-6851` · CVE record: apos37 Broken Link Notifier · CVSS 7.2 High · Not analysed yet · Published 11 Jul 2025 · Tags: Server-side request forgery (SSRF) - [A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe.](https://agentprime.io/advisories/CVE-2025-51591.md) `CVE-2025-51591` · CVE record · CVSS 3.7 Low · Not analysed yet · Published 11 Jul 2025 · Tags: Server-side request forgery (SSRF) - [DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs](https://agentprime.io/advisories/CVE-2025-53371.md) `CVE-2025-53371` · CVE record: miraheze DiscordNotifications · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2025 · Tags: Denial of service, Server-side request forgery (SSRF) - [Apache HTTP Server: SSRF on Windows due to UNC paths](https://agentprime.io/advisories/CVE-2024-43394.md) `CVE-2024-43394` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Apache HTTP Server: SSRF with mod_headers setting Content-Type header](https://agentprime.io/advisories/CVE-2024-43204.md) `CVE-2024-43204` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Server-side request forgery (SSRF) - [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2025-49545.md) `CVE-2025-49545` · CVE record: Adobe ColdFusion · CVSS 6.2 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Ivanti Connect Secure and others](https://agentprime.io/advisories/CVE-2025-0292.md) `CVE-2025-0292` · CVE record: Ivanti Connect Secure and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application](https://agentprime.io/advisories/CVE-2025-42965.md) `CVE-2025-42965` · CVE record: SAP_SE SAP BusinessObjects BI Platform Central Management Console Promotion Management Application · CVSS 4.1 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Nimesa Backup and Recovery](https://agentprime.io/advisories/CVE-2025-53473.md) `CVE-2025-53473` · CVE record: Nimesa Nimesa Backup and Recovery · CVSS 6.9 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Server-side request forgery (SSRF) - [BoyunCMS curl Index.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-7103.md) `CVE-2025-7103` · CVE record: BoyunCMS · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-49418.md) `CVE-2025-49418` · CVE record: TeconceTheme Allmart · CVSS 7.2 High · Not analysed yet · Published 4 Jul 2025 · Tags: Server-side request forgery (SSRF) - [WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-28963.md) `CVE-2025-28963` · CVE record: Md Yeasin Ul Haider URL Shortener · CVSS 5.4 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Server-side request forgery (SSRF) - [PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-6729.md) `CVE-2025-6729` · CVE record: qazomardok PayMaster for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-5817.md) `CVE-2025-5817` · CVE record: suhailahmad64 Amazon Products to WooCommerce · CVSS 7.2 High · Not analysed yet · Published 2 Jul 2025 · Tags: Server-side request forgery (SSRF) - [AVTECH DVR Devices Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-34051.md) `CVE-2025-34051` · CVE record: AVTECH DVR devices · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Information disclosure, Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .