# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Emlog vulnerable to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-21433.md)
  `CVE-2026-21433` · CVE record: emlog emlog · CVSS 7.7 High · Not analysed yet · Published 2 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery](https://agentprime.io/advisories/CVE-2025-15414.md)
  `CVE-2025-15414` · CVE record: go-sonic sonic · CVSS 5.1 Medium · Not analysed yet · Published 1 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass](https://agentprime.io/advisories/CVE-2025-14627.md)
  `CVE-2025-14627` · CVE record: smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress · CVSS 6.4 Medium · Not analysed yet · Published 1 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-62088.md)
  `CVE-2025-62088` · CVE record: extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site · CVSS 5.4 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-59138.md)
  `CVE-2025-59138` · CVE record: Jthemes Genemy · CVSS 4.9 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [EyouCMS function.php saveRemote server-side request forgery](https://agentprime.io/advisories/CVE-2025-15373.md)
  `CVE-2025-15373` · CVE record: EyouCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [FeehiCMS TimThumb timthumb.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-15264.md)
  `CVE-2025-15264` · CVE record: FeehiCMS · CVSS 6.9 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-69014.md)
  `CVE-2025-69014` · CVE record: Youzify Youzify · CVSS 4.9 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [hemmelig allows SSRF Filter bypass via Secret Request functionality](https://agentprime.io/advisories/GHSA-vvxf-wj5w-6gj5.md)
  `GHSA-vvxf-wj5w-6gj5`, `CVE-2025-69206` · npm `hemmelig`: affected `<7.3.3`, fixed in `7.3.3` · CVSS 4.3 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-68893.md)
  `CVE-2025-68893` · CVE record: HETWORKS WordPress Image shrinker · CVSS 4.9 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading.](https://agentprime.io/advisories/CVE-2024-25181.md)
  `CVE-2024-25181` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery](https://agentprime.io/advisories/CVE-2025-15098.md)
  `CVE-2025-15098` · CVE record: YunaiV yudao-cloud · CVSS 5.3 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings](https://agentprime.io/advisories/CVE-2019-25251.md)
  `CVE-2019-25251` · CVE record: Teradek, LLC VidiU Pro · CVSS 6.9 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-68600.md)
  `CVE-2025-68600` · CVE record: Yannick Lefebvre Link Library · CVSS 4.9 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67623.md)
  `CVE-2025-67623` · CVE record: 6Storage 6Storage Rentals · CVSS 5.4 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-68500.md)
  `CVE-2025-68500` · CVE record: bdthemes Prime Slider – Addons For Elementor · CVSS 4.9 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage](https://agentprime.io/advisories/GHSA-hm5p-x4rq-38w4.md)
  `GHSA-hm5p-x4rq-38w4`, `CVE-2025-68696` · RubyGems `httparty`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service](https://agentprime.io/advisories/GHSA-9c54-gxh7-ppjc.md)
  `GHSA-9c54-gxh7-ppjc`, `CVE-2025-67743`, `PYSEC-2026-1581` · PyPI `local-deep-research`: affected `>=1.3.0, <1.3.9`, fixed in `1.3.9` · CVSS 6.3 Medium · Not analysed yet · Published 23 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection](https://agentprime.io/advisories/CVE-2021-47715.md)
  `CVE-2021-47715` · CVE record: Hasura Hasura GraphQL · CVSS 6.9 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification](https://agentprime.io/advisories/GHSA-83jg-m2pm-4jxj.md)
  `GHSA-83jg-m2pm-4jxj`, `CVE-2025-34469`, `PYSEC-2026-1280` · PyPI `cowrie`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 6.9 Medium · Not analysed yet · Published 20 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Langflow vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-5993-7p27-66g5.md)
  `GHSA-5993-7p27-66g5`, `CVE-2025-68477`, `PYSEC-2026-1522` · PyPI `langflow`: affected `<1.7.1`, fixed in `1.7.1` · CVSS 7.7 High · Not analysed yet · Published 19 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-13999.md)
  `CVE-2025-13999` · CVE record: bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player · CVSS 7.2 High · Not analysed yet · Published 19 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Custom Question Answering Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-64663.md)
  `CVE-2025-64663` · CVE record: Microsoft Azure Cognitive Service for Language · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write](https://agentprime.io/advisories/CVE-2025-34452.md)
  `CVE-2025-34452` · CVE record: Streama Streama · CVSS 8.7 High · Not analysed yet · Published 18 Dec 2025 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-14277.md)
  `CVE-2025-14277` · CVE record: bdthemes Prime Slider – Addons for Elementor · CVSS 4.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter](https://agentprime.io/advisories/GHSA-3f5f-xgrj-97pf.md)
  `GHSA-3f5f-xgrj-97pf`, `BIT-parse-2025-68150`, `CVE-2025-68150` · npm `parse-server`: affected `<8.6.2 || >=9.0.0, <9.1.1-alpha.1`, fixed in `8.6.2`, `9.1.1-alpha.1` · CVSS 8.3 High · Not analysed yet · Published 16 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection](https://agentprime.io/advisories/CVE-2023-53899.md)
  `CVE-2023-53899` · CVE record: Podcastgenerator PodcastGenerator · CVSS 5.1 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References](https://agentprime.io/advisories/GHSA-gxvv-45f6-3ch8.md)
  `GHSA-gxvv-45f6-3ch8`, `CVE-2025-14443`, `GO-2026-4578` · Go `github.com/openshift/openshift-apiserver`: affected `<=0.0.0-alpha.0.0.20260130163947-0eb84cd66658`, no fixed version yet · CVSS 6.4 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-67989.md)
  `CVE-2025-67989` · CVE record: LMPixels Kerge · CVSS 5.4 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an…](https://agentprime.io/advisories/CVE-2025-52196.md)
  `CVE-2025-52196` · CVE record · CVSS 7.5 High · Not analysed yet · Published 16 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Ateme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2023-53893.md)
  `CVE-2023-53893` · CVE record: Ateme TITAN · CVSS 5.3 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Grav may be vulnerable to SSRF attack via Twig Templates](https://agentprime.io/advisories/GHSA-729w-j79f-2c34.md)
  `GHSA-729w-j79f-2c34`, `CVE-2025-66844`, `PKSA-ytd5-dvb1-2bq7` · Packagist `getgrav/grav`: affected `<=1.7.49.5`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass](https://agentprime.io/advisories/GHSA-r6j8-c6r2-37rr.md)
  `GHSA-r6j8-c6r2-37rr`, `CVE-2025-13281`, `GO-2025-4240` · Go `k8s.io/kubernetes`: affected `<1.32.10 || >=1.33.0-alpha.0, <1.33.6 || >=1.34.0-alpha.0, <1.34.2`, fixed in `1.32.10`, `1.33.6`, `1.34.2` · CVSS 5.8 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11970.md)
  `CVE-2025-11970` · CVE record: emplibot Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated · CVSS 4.4 Medium · Not analysed yet · Published 13 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [PowerJob has a server-side request forgery vulnerability in PingPongUtils.java](https://agentprime.io/advisories/GHSA-8xqm-6fj2-hfgf.md)
  `GHSA-8xqm-6fj2-hfgf`, `CVE-2025-14518` · Maven `tech.powerjob:powerjob-common`: affected `<=5.1.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery](https://agentprime.io/advisories/CVE-2025-14516.md)
  `CVE-2025-14516` · CVE record: Yalantis uCrop · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11467.md)
  `CVE-2025-11467` · CVE record: themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator · CVSS 5.8 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF](https://agentprime.io/advisories/CVE-2020-36884.md)
  `CVE-2020-36884` · CVE record: BrightSign, LLC BrightSign Digital Signage Diagnostic Web Server · CVSS 6.9 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/GHSA-8fxj-2g9q-8fjw.md)
  `GHSA-8fxj-2g9q-8fjw`, `CVE-2025-65513` · npm `mcp-fetch-server`: affected `<=1.0.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 10 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before.](https://agentprime.io/advisories/CVE-2025-65512.md)
  `CVE-2025-65512` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php](https://agentprime.io/advisories/CVE-2021-47703.md)
  `CVE-2021-47703` · CVE record: OPEN BMCS OpenBMCS · CVSS 6.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [JDA (Java Discord API) downloads external URLs when updating message components](https://agentprime.io/advisories/GHSA-93fv-4pm9-xp28.md)
  `GHSA-93fv-4pm9-xp28` · Maven `net.dv8tion:JDA`: affected `>=6.0.0, <6.1.3`, fixed in `6.1.3` · CVSS 4.0, no score published · Not analysed yet · Published 9 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [WordPress Hercules Core plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-63010.md)
  `CVE-2025-63010` · CVE record: ThemesInflow Hercules Core · CVSS 4.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login](https://agentprime.io/advisories/GHSA-7wfc-4796-gmg5.md)
  `GHSA-7wfc-4796-gmg5`, `CVE-2025-67494`, `GO-2025-4210` · Go `github.com/zitadel/zitadel` and 1 more: affected `<1.80.0-v2.20.0.20251208091519-4c879b47334e || >=1.83.4, <=1.87.5 || >=4.0.0-rc.1, <4.7.1`, fixed in `1.80.0-v2.20.0.20251208091519-4c879b47334e`, `4.7.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [IBM InfoSphere Information Server Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12832.md)
  `CVE-2025-12832` · CVE record: IBM InfoSphere Information Server · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9](https://agentprime.io/advisories/CVE-2025-26487.md)
  `CVE-2025-26487` · CVE record: Infinera MTC-9 · CVSS 8.6 High · Not analysed yet · Published 8 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery](https://agentprime.io/advisories/CVE-2025-14116.md)
  `CVE-2025-14116` · CVE record: xerrors Yuxi-Know · CVSS 5.1 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF](https://agentprime.io/advisories/CVE-2025-59775.md)
  `CVE-2025-59775` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web](https://agentprime.io/advisories/GHSA-c6xv-rcvw-v685.md)
  `GHSA-c6xv-rcvw-v685`, `CVE-2025-65958`, `PYSEC-2026-1726` · PyPI `open-webui`: affected `<0.6.37`, fixed in `0.6.37` · CVSS 8.5 High · Not analysed yet · Published 4 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [dayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7e.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-14008.md)
  `CVE-2025-14008` · CVE record: dayrui XunRuiCMS · CVSS 5.1 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [dayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgery](https://agentprime.io/advisories/CVE-2025-14004.md)
  `CVE-2025-14004` · CVE record: dayrui XunRuiCMS · CVSS 5.1 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20388.md)
  `CVE-2025-20388` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 2.7 Low · Not analysed yet · Published 3 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio](https://agentprime.io/advisories/CVE-2025-13872.md)
  `CVE-2025-13872` · CVE record: ObjectPlanet Opinio · CVSS 2.1 Low · Not analysed yet · Published 2 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host](https://agentprime.io/advisories/GHSA-hhh5-2cvx-vmfp.md)
  `GHSA-hhh5-2cvx-vmfp`, `CVE-2025-66405` · npm `@portkey-ai/gateway`: affected `<1.14.0`, fixed in `1.14.0` · CVSS 6.9 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Frontend arbitrary file read in oauth.authorize action](https://agentprime.io/advisories/CVE-2025-27232.md)
  `CVE-2025-27232` · CVE record: Zabbix Zabbix · CVSS 6.8 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery](https://agentprime.io/advisories/CVE-2025-13814.md)
  `CVE-2025-13814` · CVE record: moxi159753 Mogu Blog v2 · CVSS 6.9 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery](https://agentprime.io/advisories/CVE-2025-13809.md)
  `CVE-2025-13809` · CVE record: orionsec orion-ops · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.](https://agentprime.io/advisories/CVE-2025-65836.md)
  `CVE-2025-65836` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery](https://agentprime.io/advisories/CVE-2025-13796.md)
  `CVE-2025-13796` · CVE record: deco-cx apps · CVSS 5.3 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [ZenTao model.php makeRequest server-side request forgery](https://agentprime.io/advisories/CVE-2025-13789.md)
  `CVE-2025-13789` · CVE record: ZenTao · CVSS 5.3 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI1LTExLTMwVDEzOjMyOjE2Ljk2NDAwMFoiLCJDVkUtMjAyNS0xMzc4OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTAxLTA1VDE4OjAyOjM3LjAwMDAwMFoiLCJHSFNBLXgyN3Atd2Zxdy1oZmNjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTAxLTA1VDE4OjAyOjM3LjAwMDAwMFoiLCJHSFNBLXgyN3Atd2Zxdy1oZmNjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.