# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API.](https://agentprime.io/advisories/CVE-2025-60279.md) `CVE-2025-60279` · CVE record · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Angular SSR has a Server-Side Request Forgery (SSRF) flaw](https://agentprime.io/advisories/GHSA-q63q-pgmf-mxhr.md) `GHSA-q63q-pgmf-mxhr`, `CVE-2025-62427` · npm `@angular/ssr`: affected `>=19.0.0-next.0, <19.2.18 || >=20.0.0-next.0, <20.3.6 || >=21.0.0-next.0, <21.0.0-next.8`, fixed in `19.2.18`, `20.3.6`, `21.0.0-next.8` · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2025 · Tags: Server-side request forgery (SSRF) - [NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery](https://agentprime.io/advisories/CVE-2025-11864.md) `CVE-2025-11864` · CVE record: NucleoidAI Nucleoid · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10056.md) `CVE-2025-10056` · CVE record: miunosoft Task Scheduler · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Server-side request forgery (SSRF) - [karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).](https://agentprime.io/advisories/CVE-2025-60540.md) `CVE-2025-60540` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Server-side request forgery (SSRF) - [PiExtract｜SOOP-CLM - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11674.md) `CVE-2025-11674` · CVE record: PiExtract SOOP-CLM · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgery](https://agentprime.io/advisories/CVE-2025-11648.md) `CVE-2025-11648` · CVE record: Tomofun Furbo 360 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Tomofun Furbo 360 Account server-side request forgery](https://agentprime.io/advisories/CVE-2025-11636.md) `CVE-2025-11636` · CVE record: Tomofun Furbo 360 · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Oracle Corporation Oracle Configurator](https://agentprime.io/advisories/CVE-2025-61884.md) `CVE-2025-61884` · CVE record: Oracle Corporation Oracle Configurator · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.96 · Not analysed yet · Published 12 Oct 2025 · Tags: Path traversal, Other injection, Authentication bypass, HTTP request smuggling - [HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2025-31993.md) `CVE-2025-31993` · CVE record: HCL Software Unica Centralized Offer Management · CVSS 3.5 Low · Not analysed yet · Published 12 Oct 2025 · Tags: Server-side request forgery (SSRF) - [WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-9975.md) `CVE-2025-9975` · CVE record: rico-macchi WP Scraper · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2025 · Tags: Server-side request forgery (SSRF) - [New API has Authenticated Server-Side Request Forgery (SSRF) issue](https://agentprime.io/advisories/CVE-2025-59146.md) `CVE-2025-59146` · CVE record: QuantumNous new-api · CVSS 8.5 High · Not analysed yet · Published 9 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin](https://agentprime.io/advisories/CVE-2025-9868.md) `CVE-2025-9868` · CVE record: Sonatype Nexus Repository · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2025 · Tags: Server-side request forgery (SSRF) - [vLLM is vulnerable to Server-Side Request Forgery (SSRF) through \`MediaConnector\` class](https://agentprime.io/advisories/GHSA-3f6c-7fw2-ppm4.md) `GHSA-3f6c-7fw2-ppm4`, `CVE-2025-6242`, `PYSEC-2026-2011` · PyPI `vllm`: affected `>=0.5.0, <0.11.0`, fixed in `0.11.0` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2025 · Tags: Open redirect, Server-side request forgery (SSRF) - [LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities](https://agentprime.io/advisories/GHSA-527m-2xhr-j27g.md) `GHSA-527m-2xhr-j27g`, `CVE-2025-61784`, `PYSEC-2026-1573` · PyPI `llamafactory`: affected `<0.9.4`, fixed in `0.9.4` · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2025 · Tags: Path traversal, Server-side request forgery (SSRF) - [Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload](https://agentprime.io/advisories/CVE-2025-61768.md) `CVE-2025-61768` · CVE record: xuemian168 kuno · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Unrestricted file upload, Server-side request forgery (SSRF), CWE-20 - [samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery](https://agentprime.io/advisories/CVE-2025-11286.md) `CVE-2025-11286` · CVE record: samanhappy MCPHub · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Server-side request forgery (SSRF) - [OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints](https://agentprime.io/advisories/CVE-2025-10695.md) `CVE-2025-10695` · CVE record: OpenSupports OpenSupports · CVSS 6.9 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Server-side request forgery (SSRF) - [TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via t…](https://agentprime.io/advisories/CVE-2025-55971.md) `CVE-2025-55971` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Secure Access](https://agentprime.io/advisories/CVE-2025-54087.md) `CVE-2025-54087` · CVE record: Absolute Security Secure Access · CVSS 1.8 Low · Not analysed yet · Published 2 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/GHSA-f6m8-qm7j-fh65.md) `GHSA-f6m8-qm7j-fh65`, `CVE-2025-61735` · Maven `org.apache.kylin:kylin` and 6 more: affected `>=4.0.0, <5.0.3`, fixed in `5.0.3` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2025 · Tags: Server-side request forgery (SSRF) - [VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.](https://agentprime.io/advisories/CVE-2025-57305.md) `CVE-2025-57305` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20371.md) `CVE-2025-20371` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10735.md) `CVE-2025-10735` · CVE record: bplugins Block for Mailchimp – Add Email Subscription Forms and Collect Leads · CVSS 4.0 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.](https://agentprime.io/advisories/CVE-2025-56520.md) `CVE-2025-56520` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php](https://agentprime.io/advisories/CVE-2025-34228.md) `CVE-2025-34228` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php](https://agentprime.io/advisories/CVE-2025-34229.md) `CVE-2025-34229` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php](https://agentprime.io/advisories/CVE-2025-34230.md) `CVE-2025-34230` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php](https://agentprime.io/advisories/CVE-2025-34231.md) `CVE-2025-34231` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) SSRF via console_release Directory](https://agentprime.io/advisories/CVE-2025-34225.md) `CVE-2025-34225` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()](https://agentprime.io/advisories/CVE-2025-34233.md) `CVE-2025-34233` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php](https://agentprime.io/advisories/CVE-2025-34232.md) `CVE-2025-34232` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Tencent WeKnora test testEmbeddingModel server-side request forgery](https://agentprime.io/advisories/CVE-2025-11046.md) `CVE-2025-11046` · CVE record: Tencent WeKnora · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-60181.md) `CVE-2025-60181` · CVE record: silence Silencesoft RSS Reader · CVSS 5.4 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-60161.md) `CVE-2025-60161` · CVE record: bdthemes ZoloBlocks · CVSS 5.4 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10137.md) `CVE-2025-10137` · CVE record: inc2734 Snow Monkey · CVSS 5.4 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Server-side request forgery (SSRF) - [cors-anywhere vulnerable to server-side request forgery](https://agentprime.io/advisories/GHSA-r3jv-xfgx-gj24.md) `GHSA-r3jv-xfgx-gj24`, `CVE-2020-36851` · npm `cors-anywhere`: affected `<=0.4.4`, no fixed version yet · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2025 · Tags: Server-side request forgery (SSRF), CWE-942 - [Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://agentprime.io/advisories/GHSA-g2rq-jv54-wcpr.md) `GHSA-g2rq-jv54-wcpr`, `CVE-2025-59346`, `GO-2025-3968` · Go `d7y.io/dragonfly/v2` and 1 more: affected `<2.1.0`, fixed in `2.1.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery in SAP BI Platform](https://agentprime.io/advisories/CVE-2025-42907.md) `CVE-2025-42907` · CVE record: SAP_SE SAP BI Platform · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Server-side request forgery (SSRF) - [is-localhost-ip 2.0.0 - SSRF via Restrictions bypass](https://agentprime.io/advisories/CVE-2025-9960.md) `CVE-2025-9960` · CVE record: is-localhost-ip is-localhost-ip · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58962.md) `CVE-2025-58962` · CVE record: publitio Publitio · CVSS 6.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-53457.md) `CVE-2025-53457` · CVE record: activewebsight SEO Backlink Monitor · CVSS 4.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-53461.md) `CVE-2025-53461` · CVE record: Binsaifullah Beaf · CVSS 4.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-57943.md) `CVE-2025-57943` · CVE record: Skimlinks Skimlinks Affiliate Marketing Tool · CVSS 4.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-57984.md) `CVE-2025-57984` · CVE record: Pratik Ghela MakeStories (for Google Web Stories) · CVSS 4.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/CVE-2025-58005.md) `CVE-2025-58005` · CVE record: SmartDataSoft DriCub · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58011.md) `CVE-2025-58011` · CVE record: Alex Content Mask · CVSS 6.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [IBM webMethods Integration server-side request forgery](https://agentprime.io/advisories/CVE-2025-36037.md) `CVE-2025-36037` · CVE record: IBM webMethods Integration · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [MuYuCMS Add Fiend Link index.html server-side request forgery](https://agentprime.io/advisories/CVE-2025-10787.md) `CVE-2025-10787` · CVE record: MuYuCMS · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Server-side request forgery (SSRF) - [SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery](https://agentprime.io/advisories/CVE-2025-10765.md) `CVE-2025-10765` · CVE record: SeriaWei ZKEACMS · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Server-side request forgery (SSRF) - [SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery](https://agentprime.io/advisories/CVE-2025-10764.md) `CVE-2025-10764` · CVE record: SeriaWei ZKEACMS · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Harness lookup_repo.go LookupRepo server-side request forgery](https://agentprime.io/advisories/CVE-2025-10760.md) `CVE-2025-10760` · CVE record: Harness · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Server-side request forgery (SSRF) - [CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)](https://agentprime.io/advisories/CVE-2025-26515.md) `CVE-2025-26515` · CVE record: NetApp StorageGRID · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2025 · Tags: Server-side request forgery (SSRF) - [AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction](https://agentprime.io/advisories/CVE-2025-59344.md) `CVE-2025-59344` · CVE record: aliasvault aliasvault · CVSS 7.7 High · Not analysed yet · Published 19 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature.](https://agentprime.io/advisories/CVE-2025-57644.md) `CVE-2025-57644` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2025 · Tags: Path traversal, Code injection, Server-side request forgery (SSRF), CWE-20 - [WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.](https://agentprime.io/advisories/CVE-2025-57055.md) `CVE-2025-57055` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in fedorindutny ip](https://agentprime.io/advisories/CVE-2025-59437.md) `CVE-2025-59437` · CVE record: fedorindutny ip · CVSS 3.2 Low · Not analysed yet · Published 16 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in fedorindutny ip](https://agentprime.io/advisories/CVE-2025-59436.md) `CVE-2025-59436` · CVE record: fedorindutny ip · CVSS 3.2 Low · Not analysed yet · Published 16 Sept 2025 · Tags: Server-side request forgery (SSRF) - [HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/GHSA-g5cg-6c7v-mmpw.md) `GHSA-g5cg-6c7v-mmpw`, `CVE-2025-59155` · npm `hackmd-mcp`: affected `>=1.4.0, <1.5.0`, fixed in `1.5.0` · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark](https://agentprime.io/advisories/GHSA-f7qg-xj45-w956.md) `GHSA-f7qg-xj45-w956`, `BIT-ghost-2025-9862`, `CVE-2025-9862` · npm `ghost`: affected `>=5.99.0, <5.130.4 || >=6.0.0, <6.0.9`, fixed in `5.130.4`, `6.0.9` · CVSS 6.1 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .