Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Server-side request forgery in Akamai CloudTest
- Akamai CloudTest
- Server-side request forgery (SSRF)
- CVSS 7.5 High
MobSF vulnerability allows SSRF due to the allow_redirects=True parameter
- Server-side request forgery (SSRF)
<3.9.7 · fixed in 3.9.7
GHSA-m435-9v6r-v5f6 · CVE-2024-54000 - CVSS 3.0 Low
Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs
- Lychee
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
diyhi bbs HTTP Header login getUrl server-side request forgery
- diyhi bbs
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
- techjewel Ninja Tables – Easy Data Table Builder
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
- Server-side request forgery (SSRF)
<0.5.3 · fixed in 0.5.3
GHSA-h3qp-hwvr-9xcq · CVE-2025-52477 - CVSS 5.3 Medium
Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, In…
- Brother Industries, Ltd HL-L8260CDN
- Brother Industries, Ltd HL-L8260CDW
- Other injection
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Unauthenticated Server Side Request Forgery (SSRF) via WS-Addressing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
- Brother Industries, Ltd HL-L8260CDN
- Brother Industries, Ltd HL-L8260CDW
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises
- ControlID iDSecure On-premises
- Server-side request forgery (SSRF)
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.Reque...
- Server-side request forgery (SSRF)
<0.0.28 · fixed in 0.0.28
GHSA-h5gc-rm8j-5gpr · CVE-2025-2828 - CVSS 5.3 Medium
Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
- Dromara MaxKey
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-wxj7-3fx5-pp9m · CVE-2025-52967 - CVSS 7.8 High
Selea Targa IP OCR-ANPR Camera Server-Side Request Forgery
- Selea Targa IP OCR-ANPR Camera
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 4.9 Medium
WordPress WPThumb plugin <= 0.10 - Server Side Request Forgery (SSRF) Vulnerability
- Joe Hoyle WPThumb
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress PowerPress Podcasting plugin <= 11.13.11 - Server Side Request Forgery (SSRF) Vulnerability
- blubrry PowerPress Podcasting
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Auto Upload Images plugin <= 3.3.2 - Server Side Request Forgery (SSRF) Vulnerability
- Ali Irani Auto Upload Images
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability
- Post and Page Builder by BoldGrid
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
PowSyBl Core XML Reader allows XXE and SSRF
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<6.7.2 · fixed in 6.7.2
GHSA-qpj9-qcwx-8jv2 · CVE-2025-47293 - CVSS 7.2 High
Server-side request forgery in Versa Director
- Versa Director
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central
- Trend Micro, Inc. Trend Micro Apex Central
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central
- Trend Micro, Inc. Trend Micro Apex Central
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-side request forgery in Trend Micro, Inc. Trend Micro Apex Central
- Trend Micro, Inc. Trend Micro Apex Central
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability
- Metagauss ProfileGrid
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Intera InHire server-side request forgery
- Intera InHire
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-Side Request Forgery
- SICK AG SICK Field Analytics
- Server-side request forgery (SSRF)
- CVSS 7.5 High
GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
- Server-side request forgery (SSRF)
>=1.0.0, <2.24.4 || >=2.25.0, <2.25.2 · fixed in 2.24.4, 2.25.2
GHSA-68cf-j696-wvv9 - CVSS 8.2 High
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
- XML external entities (XXE)
- Server-side request forgery (SSRF)
>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13 · fixed in 4.4.8, 4.2.13
GHSA-2p76-gc46-5fvc - CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
- XML external entities (XXE)
- Server-side request forgery (SSRF)
>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7 · fixed in 2.27.1, 2.26.3, 2.25.7
GHSA-jj54-8f66-c5pc · CVE-2025-30220 - CVSS 4.1 Medium
Server-side request forgery in Fortinet FortiClientEMS
- Fortinet FortiClientEMS
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Coverage REST API Server Side Request Forgery
- Server-side request forgery (SSRF)
<2.26.0 · fixed in 2.26.0
GHSA-r4hf-r8gj-jgw2 · CVE-2024-40625 - CVSS 9.3 CriticalCritical · CVSS 9+
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
- Information disclosure
- XML external entities (XXE)
<2.25.0 · fixed in 2.25.0
GHSA-mc43-4fqr-c965 · CVE-2024-34711 - CVSS 7.5 High
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
- Server-side request forgery (SSRF)
>=2.0.0, <2.24.4 || >=2.25.0, <2.25.2 · fixed in 2.24.4, 2.25.2
GHSA-5gw5-jccf-6hxw · CVE-2024-29198 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
- Server-side request forgery (SSRF)
>=3.1.0, <3.9.1 · fixed in 3.9.1
GHSA-vgq5-3255-v292 · CVE-2025-27817 - CVSS 3.7 Low
Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
- SAP_SE SAP Business Objects Business Intelligence Platform
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyoti_SearchEngine_Web_Common/SearchService…
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress SocialMark plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability
- ShawonPro SocialMark
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability
- wpdive Nexa Blocks
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Car Repair Services theme <= 5.0 - Server Side Request Forgery (SSRF) Vulnerability
- SmartDataSoft Car Repair Services
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Privilege escalation via SSRF when using HTTP auth
- FreshRSS
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-side request forgery in Acronis Cyber Protect 16
- Acronis Cyber Protect 16
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
quequnlong shiyi-blog optimize server-side request forgery
- quequnlong shiyi-blog
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-side request forgery in Hewlett Packard Enterprise (HPE) HPE StoreOnce Software
- Hewlett Packard Enterprise (HPE) HPE StoreOnce Software
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
chshcms mccms Gf.php index server-side request forgery
- chshcms mccms
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS
- Esri Portal for ArcGIS
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function
- Server-side request forgery (SSRF)
<=0.0.1 · no fixed version yet
GHSA-frq9-3hp2-xvxg · CVE-2025-5276 - CVSS 7.3 High
maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
- Server-side request forgery (SSRF)
- CWE-402
<8.4.1 · fixed in 8.4.1
GHSA-wjrh-hj83-3wh7 · CVE-2025-48383 - CVSS 4.9 Medium
Strapi allows Server-Side Request Forgery in Webhook function
- Server-side request forgery (SSRF)
<4.25.2 · fixed in 4.25.2
GHSA-v8wj-f5c7-pvxf · CVE-2024-52588 - CVSS 5.4 Medium
maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery
- thinkgem JeeSite
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Seeyon Zhiyuan OA Web Application System ThirdMenuController.class this.oursNetService.getData server-side request forgery
- Seeyon Zhiyuan OA Web Application System
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
Server-side request forgery in StrangeBee TheHive
- StrangeBee TheHive
- Server-side request forgery (SSRF)
- CVSS 7.0 High
SSRF Server Side Request Forgery
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- Server-side request forgery (SSRF)
- CVSS 3.3 Low
TYPO3 CMS Webhooks Server Side Request Forgery
- Server-side request forgery (SSRF)
>=12.0.0, <12.4.31 || >=13.0.0, <13.4.12 · fixed in 12.4.31, 13.4.12
GHSA-p4xx-m758-3hpx · CVE-2025-47936 - CVSS 9.2 CriticalCritical · CVSS 9+
Server-side request forgery in appleple inc. a-blog cms
- appleple inc. a-blog cms
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Nextcloud Server's test remote endpoint is not rate limited
- nextcloud security-advisories
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Server-side request forgery in SonicWall SMA1000
- SonicWall SMA1000
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook
- Ninja Forms Webhooks
- Server-side request forgery (SSRF)