# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability](https://agentprime.io/advisories/CVE-2025-66201.md)
  `CVE-2025-66201` · CVE record: danny-avila LibreChat · CVSS 8.6 High · Not analysed yet · Published 29 Nov 2025 · Tags: Server-side request forgery (SSRF), CWE-20
- [AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter](https://agentprime.io/advisories/CVE-2025-13378.md)
  `CVE-2025-13378` · CVE record: ays-pro AI ChatBot with ChatGPT and Content Generator by AYS · CVSS 6.5 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read](https://agentprime.io/advisories/CVE-2025-34350.md)
  `CVE-2025-34350` · CVE record: Synergetic Data Systems, Inc. UnForm Server · CVSS 8.7 High · Not analysed yet · Published 25 Nov 2025 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Server-side request forgery in NVIDIA NeMo Agent ToolKit](https://agentprime.io/advisories/CVE-2025-33203.md)
  `CVE-2025-33203` · CVE record: NVIDIA NeMo Agent ToolKit · CVSS 7.6 High · Not analysed yet · Published 25 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [new-api is vulnerable to SSRF Bypass](https://agentprime.io/advisories/GHSA-9f46-w24h-69w4.md)
  `GHSA-9f46-w24h-69w4`, `CVE-2025-62155`, `GO-2025-4154` · Go `github.com/QuantumNous/new-api`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 8.5 High · Not analysed yet · Published 24 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-13588.md)
  `CVE-2025-13588` · CVE record: lKinderBueno Streamity Xtream IPTV Player · CVSS 5.3 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12800.md)
  `CVE-2025-12800` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 23 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Azure Monitor Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-62207.md)
  `CVE-2025-62207` · CVE record: Microsoft Azure Monitor Control Service · CVSS 8.6 High · Not analysed yet · Published 20 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [External Service Interaction (DNS)](https://agentprime.io/advisories/CVE-2025-13147.md)
  `CVE-2025-13147` · CVE record: Progress MOVEit Transfer · CVSS 5.3 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12359.md)
  `CVE-2025-12359` · CVE record: dfactory Responsive Lightbox & Gallery · CVSS 5.4 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12376.md)
  `CVE-2025-12376` · CVE record: bplugins Icon List Block – Add Icon-Based Lists with Custom Styles · CVSS 6.4 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-8084.md)
  `CVE-2025-8084` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11427.md)
  `CVE-2025-11427` · CVE record: wpengine WP Migrate Lite – Migration Made Easy · CVSS 5.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode](https://agentprime.io/advisories/CVE-2025-12962.md)
  `CVE-2025-12962` · CVE record: willbontrager Local Syndication · CVSS 6.4 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to sensitive information, cause a server-side forgery request…](https://agentprime.io/advisories/CVE-2025-63408.md)
  `CVE-2025-63408` · CVE record · CVSS 5.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Command injection, Server-side request forgery (SSRF)
- [Jellysweep uses uncontrolled data in image cache API endpoint in github.com/jon4hz/jellysweep](https://agentprime.io/advisories/GHSA-xc93-q32j-cpcg.md)
  `GHSA-xc93-q32j-cpcg`, `CVE-2025-64178`, `GO-2025-4091` · Go `github.com/jon4hz/jellysweep`: affected `<0.13.0`, fixed in `0.13.0` · CVSS 8.9 High · Not analysed yet · Published 17 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Soft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve](https://agentprime.io/advisories/GHSA-vwq2-jx9q-9h9f.md)
  `GHSA-vwq2-jx9q-9h9f`, `CVE-2025-64522`, `GO-2025-4111` · Go `github.com/charmbracelet/soft-serve`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery](https://agentprime.io/advisories/CVE-2025-13174.md)
  `CVE-2025-13174` · CVE record: rachelos WeRSS we-mp-rss · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructure.](https://agentprime.io/advisories/CVE-2025-54560.md)
  `CVE-2025-54560` · CVE record · CVSS 3.8 Low · Not analysed yet · Published 14 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass](https://agentprime.io/advisories/GHSA-hr2q-hp5q-x767.md)
  `GHSA-hr2q-hp5q-x767`, `CVE-2025-64525` · npm `astro`: affected `>=2.16.0, <5.15.5`, fixed in `5.15.5` · CVSS 6.5 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [grist-core has path to server-side requests via websocket](https://agentprime.io/advisories/CVE-2025-64752.md)
  `CVE-2025-64752` · CVE record: gristlabs grist-core · CVSS 6.8 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block](https://agentprime.io/advisories/CVE-2025-64709.md)
  `CVE-2025-64709` · CVE record: baptisteArno typebot.io · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [MaxKB has SSRF in sandbox](https://agentprime.io/advisories/CVE-2025-64511.md)
  `CVE-2025-64511` · CVE record: 1Panel-dev MaxKB · CVSS 7.4 High · Not analysed yet · Published 13 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API.](https://agentprime.io/advisories/CVE-2025-52186.md)
  `CVE-2025-52186` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv](https://agentprime.io/advisories/CVE-2025-59088.md)
  `CVE-2025-59088` · CVE record: latchset kdcproxy and 4 more · CVSS 8.6 High · Not analysed yet · Published 12 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)](https://agentprime.io/advisories/CVE-2025-64180.md)
  `CVE-2025-64180` · CVE record: Manager-io Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2025 · Tags: Race condition, Server-side request forgery (SSRF)
- [ThinkDashboard: Blind Server-Side Request Forgery (SSRF) vulnerability in /api/ping Endpoint](https://agentprime.io/advisories/CVE-2025-64327.md)
  `CVE-2025-64327` · CVE record: MatiasDesuu ThinkDashboard · CVSS 5.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url](https://agentprime.io/advisories/CVE-2025-12560.md)
  `CVE-2025-12560` · CVE record: pr-gateway Blog2Social: Social Media Auto Post & Scheduler · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.](https://agentprime.io/advisories/CVE-2025-63551.md)
  `CVE-2025-63551` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.](https://agentprime.io/advisories/CVE-2025-60541.md)
  `CVE-2025-60541` · CVE record · CVSS 7.3 High · Not analysed yet · Published 6 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [DataEase's DB2 is vulnerable to SSRF](https://agentprime.io/advisories/CVE-2025-64163.md)
  `CVE-2025-64163` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 5 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format](https://agentprime.io/advisories/GHSA-x4qj-2f4q-r4rx.md)
  `GHSA-x4qj-2f4q-r4rx`, `BIT-parse-2025-64430`, `CVE-2025-64430` · npm `parse-server`: affected `>=4.2.0, <7.5.4 || >=8.0.0, <8.4.0-alpha.2`, fixed in `7.5.4`, `8.4.0-alpha.2` · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12388.md)
  `CVE-2025-12388` · CVE record: bplugins Carousel Block – Responsive Image and Content Carousel · CVSS 6.4 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed](https://agentprime.io/advisories/CVE-2025-11917.md)
  `CVE-2025-11917` · CVE record: etruel WPeMatico RSS Feed Fetcher · CVSS 6.4 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality](https://agentprime.io/advisories/CVE-2025-62719.md)
  `CVE-2025-62719` · CVE record: Kovah LinkAce · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts](https://agentprime.io/advisories/CVE-2020-36862.md)
  `CVE-2020-36862` · CVE record: Nagios XI · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF)
- [Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF](https://agentprime.io/advisories/CVE-2023-7325.md)
  `CVE-2023-7325` · CVE record: Anheng Information (Hangzhou DBAPP Security Information Technology Co., Ltd.) Mingyu Operations and Maintenance Audit and Risk Control System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).](https://agentprime.io/advisories/CVE-2025-60319.md)
  `CVE-2025-60319` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-mq84-hjqx-cwf2.md)
  `GHSA-mq84-hjqx-cwf2`, `CVE-2025-12058`, `GHSA-qg93-c7p6-gg7f`, `PYSEC-2026-1487` · PyPI `keras`: affected `<3.12.0`, fixed in `3.12.0` · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-…](https://agentprime.io/advisories/CVE-2025-60898.md)
  `CVE-2025-60898` · CVE record · CVSS 5.8 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Astro's bypass of image proxy domain validation leads to SSRF and potential XSS](https://agentprime.io/advisories/GHSA-qcpr-679q-rhm2.md)
  `GHSA-qcpr-679q-rhm2`, `CVE-2025-59837` · npm `astro`: affected `>=5.13.4, <5.13.10`, fixed in `5.13.10` · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2025 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF)
- [Multiple Vulnerabilities in IBM Concert Software.](https://agentprime.io/advisories/CVE-2025-36085.md)
  `CVE-2025-36085` · CVE record: IBM Concert · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Slider Templates plugin <= 1.0.3 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62988.md)
  `CVE-2025-62988` · CVE record: Codeless Slider Templates · CVSS 4.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10861.md)
  `CVE-2025-10861` · CVE record: roxnor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-5350.md)
  `CVE-2025-5350` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF)
- [Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint](https://agentprime.io/advisories/CVE-2025-12136.md)
  `CVE-2025-12136` · CVE record: devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10874.md)
  `CVE-2025-10874` · CVE record: Unknown Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More · CVSS 5.5 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Azure Compute Resource Provider Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-59503.md)
  `CVE-2025-59503` · CVE record: Microsoft Azure Compute Resource Provider · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-10705.md)
  `CVE-2025-10705` · CVE record: mxchat MxChat – AI Chatbot & Content Generation for WordPress · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11128.md)
  `CVE-2025-11128` · CVE record: themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator · CVSS 5.0 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [FastGPT File Reading Node SSRF Vulnerability](https://agentprime.io/advisories/CVE-2025-62612.md)
  `CVE-2025-62612` · CVE record: labring FastGPT · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49917.md)
  `CVE-2025-49917` · CVE record: Icegram Icegram Express Pro · CVSS 4.4 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Captcha.eu plugin <= 1.0.61 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-49374.md)
  `CVE-2025-49374` · CVE record: captcha.eu Captcha.eu · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice](https://agentprime.io/advisories/GHSA-3cpp-fv95-mpr5.md)
  `GHSA-3cpp-fv95-mpr5`, `PKSA-h5dj-jyqc-4fjr`, `PKSA-ph5g-5w5h-nqtz` · Packagist `shopware/core` and 1 more: affected `<6.6.10.7 || >=6.7.0.0, <6.7.3.1`, fixed in `6.6.10.7`, `6.7.3.1` · CVSS 2.7 Low · Not analysed yet · Published 21 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Zimbra Collaboration](https://agentprime.io/advisories/CVE-2025-62763.md)
  `CVE-2025-62763` · CVE record: Zimbra Collaboration · CVSS 5.0 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11536.md)
  `CVE-2025-11536` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter](https://agentprime.io/advisories/CVE-2025-61488.md)
  `CVE-2025-61488` · CVE record · CVSS 7.6 High · Not analysed yet · Published 20 Oct 2025 · Tags: Code injection, Server-side request forgery (SSRF)
- [Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11361.md)
  `CVE-2025-11361` · CVE record: wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns · CVSS 6.4 Medium · Not analysed yet · Published 18 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [ThingsBoard < v4.2.1 SVG Image SSRF](https://agentprime.io/advisories/CVE-2025-34282.md)
  `CVE-2025-34282` · CVE record: ThingsBoard, Inc. ThingsBoard · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module](https://agentprime.io/advisories/GHSA-fgx4-p8xf-qhp9.md)
  `GHSA-fgx4-p8xf-qhp9`, `CVE-2025-62505` · npm `@lobehub/chat`: affected `<1.136.2`, fixed in `1.136.2` · CVSS 3.0 Low · Not analysed yet · Published 17 Oct 2025 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI1LTEwLTE3VDE3OjQ2OjA5LjAwMDAwMFoiLCJHSFNBLWZneDQtcDh4Zi1xaHA5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI1LTExLTMwVDEzOjMyOjE2Ljk2NDAwMFoiLCJDVkUtMjAyNS0xMzc4OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI1LTExLTMwVDEzOjMyOjE2Ljk2NDAwMFoiLCJDVkUtMjAyNS0xMzc4OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.