Advisories · Weakness

Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-45887 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
- Server-side request forgery (SSRF)
Not analysed yet 9 May 2025
CVE-2025-47733 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Microsoft Power Apps Information Disclosure Vulnerability
- Microsoft Power Pages
- Server-side request forgery (SSRF)
Not analysed yet 8 May 2025
CVE-2025-29972 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Azure Storage Resource Provider Spoofing Vulnerability
- Microsoft Azure Storage Resource Provider (SRP)
- Server-side request forgery (SSRF)
Not analysed yet 8 May 2025
CVE-2025-47664 CVE record

CVSS 4.4 Medium

WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability
- ThimPress WP Pipes
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-47635 CVE record

CVSS 5.5 Medium

WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability
- WPWebinarSystem WebinarPress
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-47548 CVE record

CVSS 5.4 Medium

WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin <= 1.4.4 - Server Side Request Forgery (SSRF) Vulnerability
- Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-47484 CVE record

CVSS 6.4 Medium

WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability
- Oliver Campion Display Remote Posts Block
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-47483 CVE record

CVSS 4.9 Medium

WordPress Easy Replace Image plugin <= 3.5.0 - Server Side Request Forgery (SSRF) Vulnerability
- Iulia Cazan Easy Replace Image
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-47464 CVE record

CVSS 4.9 Medium

WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability
- solacewp Solace Extra
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-45250 CVE record

CVSS 5.5 Medium

MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
- Server-side request forgery (SSRF)
Not analysed yet 6 May 2025
CVE-2024-55910 CVE record

CVSS 6.5 Medium

IBM Concert Software server-side request forgery
- IBM Concert Software
- Server-side request forgery (SSRF)
Not analysed yet 2 May 2025
CVE-2025-46568 CVE record

CVSS 7.7 High

Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability
- Stirling-Tools Stirling-PDF
- Server-side request forgery (SSRF)
Not analysed yet 1 May 2025
CVE-2024-13845 CVE record

CVSS 5.5 Medium

Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
- Gravity Forms WebHooks
- Server-side request forgery (SSRF)
Not analysed yet 1 May 2025
CVE-2024-48907 CVE record

CVSS 7.5 High

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.
- Server-side request forgery (SSRF)
Not analysed yet 1 May 2025
CVE-2025-2170 CVE record

CVSS 7.2 High

Server-side request forgery in SonicWall SMA1000
- SonicWall SMA1000
- Server-side request forgery (SSRF)
Not analysed yet 30 Apr 2025
CVE-2025-4012 CVE record

CVSS 5.1 Medium

playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery
- playeduxyz PlayEdu 开源培训系统
- Server-side request forgery (SSRF)
Not analysed yet 28 Apr 2025
CVE-2023-35817 CVE record

CVSS 5.0 Medium

Server-side request forgery in DevExpress
- DevExpress
- Server-side request forgery (SSRF)
Not analysed yet 28 Apr 2025
CVE-2025-3954 CVE record

CVSS 6.3 Medium

ChurchCRM Referer server-side request forgery
- ChurchCRM
- Server-side request forgery (SSRF)
Not analysed yet 26 Apr 2025
CVE-2025-3775 CVE record

CVSS 6.5 Medium

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter
- devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- Server-side request forgery (SSRF)
Not analysed yet 25 Apr 2025
CVE-2025-46531 CVE record

CVSS 4.9 Medium

WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability
- Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads)
- Server-side request forgery (SSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46511 CVE record

CVSS 6.4 Medium

WordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability
- Derek Springer BeerXML Shortcode
- Server-side request forgery (SSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46503 CVE record

CVSS 4.9 Medium

WordPress Simple Google Photos Grid plugin <= 1.5 - Server Side Request Forgery (SSRF) Vulnerability
- josheli Simple Google Photos Grid
- Server-side request forgery (SSRF)
Not analysed yet 24 Apr 2025
CVE-2025-46443 CVE record

CVSS 4.9 Medium

WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability
- Adam Pery Animate
- Server-side request forgery (SSRF)
Not analysed yet 24 Apr 2025
CVE-2025-1522 CVE record

CVSS 7.1 High

PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
- PostHog
- Server-side request forgery (SSRF)
Not analysed yet 23 Apr 2025
CVE-2025-1521 CVE record

CVSS 7.1 High

PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability
- PostHog
- Server-side request forgery (SSRF)
Not analysed yet 23 Apr 2025
CVE-2025-27907 CVE record

CVSS 4.1 Medium

IBM WebSphere Application Server server-side request forgery
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 22 Apr 2025
CVE-2025-2987 CVE record

CVSS 3.8 Low

IBM Maximo Asset Management server-side request forgery
- IBM Maximo Asset Management
- Server-side request forgery (SSRF)
Not analysed yet 21 Apr 2025
crawl4ai PyPI

CVSS 9.1 CriticalCritical · CVSS 9+

Crawl4AI SSRF vulnerability
- Server-side request forgery (SSRF)
<=0.4.247 · no fixed version yet

GHSA-445m-27cf-gr3x · CVE-2025-28197 Not analysed yet 18 Apr 2025
CVE-2025-3787 CVE record

CVSS 5.1 Medium

PbootCMS Image server-side request forgery
- PbootCMS
- Server-side request forgery (SSRF)
Not analysed yet 18 Apr 2025
CVE-2025-29461 CVE record

CVSS 7.6 High

An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29460 CVE record

CVSS 7.6 High

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29459 CVE record

CVSS 7.6 High

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29458 CVE record

CVSS 7.6 High

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29457 CVE record

CVSS 7.6 High

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29456 CVE record

CVSS 6.5 Medium

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29455 CVE record

CVSS 6.5 Medium

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29454 CVE record

CVSS 6.5 Medium

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29453 CVE record

CVSS 6.5 Medium

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings component.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29452 CVE record

CVSS 7.6 High

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29451 CVE record

CVSS 7.6 High

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29450 CVE record

CVSS 6.5 Medium

An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2025-29449 CVE record

CVSS 6.5 Medium

An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function.
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2025
CVE-2024-56736 CVE record

CVSS 6.5 Medium

Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss
- Apache Software Foundation Apache HertzBeat
- Server-side request forgery (SSRF)
Not analysed yet 16 Apr 2025
CVE-2025-3691 CVE record

CVSS 5.1 Medium

mirweiye Seven Bears Library CMS Add Link server-side request forgery
- mirweiye Seven Bears Library CMS
- Server-side request forgery (SSRF)
Not analysed yet 16 Apr 2025
github.com/kyverno/kyverno Go

CVSS 6.9 Medium

Kyverno vulnerable to SSRF via Service Calls
- Server-side request forgery (SSRF)
<=1.13.4 · no fixed version yet

GHSA-459x-q9hg-4gpq · CVE-2025-15613 Not analysed yet 15 Apr 2025
CVE-2025-30964 CVE record

CVSS 5.4 Medium

WordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerability
- ThemeGoods Photography
- Server-side request forgery (SSRF)
Not analysed yet 15 Apr 2025
CVE-2025-26990 CVE record

CVSS 4.4 Medium

WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability
- WP Royal Royal Elementor Addons
- Server-side request forgery (SSRF)
Not analysed yet 15 Apr 2025
CVE-2025-32102 CVE record

CVSS 5.0 Medium

Server-side request forgery in CrushFTP
- CrushFTP
- Server-side request forgery (SSRF)
Not analysed yet 15 Apr 2025
CVE-2025-31490 CVE record

CVSS 7.5 High

AutoGPT allows SSRF due to DNS Rebinding in requests wrapper
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
Not analysed yet 14 Apr 2025
CVE-2025-3572 CVE record

CVSS 7.5 High

INTUMIT SmartRobot - Server-Side Request Forgery
- INTUMIT SmartRobot
- Server-side request forgery (SSRF)
Not analysed yet 14 Apr 2025
CVE-2025-29720 CVE record

CVSS 4.8 Medium

Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.
- Server-side request forgery (SSRF)
Not analysed yet 14 Apr 2025
surrealdb crates.io

CVSS 5.8 Medium

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
- Server-side request forgery (SSRF)
<2.0.5 || >=2.1.0, <2.1.5 || >=2.2.0, <2.2.2 · fixed in 2.0.5, 2.1.5, 2.2.2

GHSA-5q9x-554g-9jgg · CVE-2025-71398 Not analysed yet 11 Apr 2025
CVE-2025-22374 CVE record

CVSS 6.0 Medium

SSRF in CyberAudit-Web videx-legacy-ssl
- Videx Inc. CyberAudit-Web
- Server-side request forgery (SSRF)
Not analysed yet 10 Apr 2025
CVE-2025-0539 CVE record

CVSS 5.9 Medium

Server-side request forgery in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Apr 2025
CVE-2025-31009 CVE record

CVSS 5.4 Medium

WordPress IndieBlocks plugin <= 0.13.1 - Server Side Request Forgery (SSRF) Vulnerability
- Jan Boddez IndieBlocks
- Server-side request forgery (SSRF)
Not analysed yet 9 Apr 2025
CVE-2025-32487 CVE record

CVSS 4.9 Medium

WordPress Waymark plugin <= 1.5.2 - Server Side Request Forgery (SSRF) Vulnerability
- Joe Waymark
- Server-side request forgery (SSRF)
Not analysed yet 9 Apr 2025
CVE-2025-32675 CVE record

CVSS 6.8 Medium

WordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability
- QuantumCloud SEO Help
- Server-side request forgery (SSRF)
Not analysed yet 9 Apr 2025
CVE-2025-32691 CVE record

CVSS 4.9 Medium

WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability
- blubrry PowerPress Podcasting
- Server-side request forgery (SSRF)
Not analysed yet 9 Apr 2025
DotNetNuke.Core NuGet

CVSS 6.5 Medium

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<9.13.8 · fixed in 9.13.8

GHSA-3f7v-qx94-666m · CVE-2025-32372 Not analysed yet 9 Apr 2025
CVE-2025-3412 CVE record

CVSS 5.3 Medium

mymagicpower AIAS InferController.java server-side request forgery
- mymagicpower AIAS
- Server-side request forgery (SSRF)
Not analysed yet 8 Apr 2025