Advisories · Weakness

Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-53760 CVE record

CVSS 7.1 HighCritical · CVSS 7+ and EPSS

Microsoft SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Server-side request forgery (SSRF)
Not analysed yet 12 Aug 2025
CVE-2025-7622 CVE record

CVSS 5.1 Medium

Server-side request forgery in Axis Communications AB AXIS Camera Station Pro and others
- Axis Communications AB AXIS Camera Station Pro
- Axis Communications AB AXIS Camera Station
- Server-side request forgery (SSRF)
Not analysed yet 12 Aug 2025
CVE-2025-55161 CVE record

CVSS 8.6 High

Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
- Stirling-Tools Stirling-PDF
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2025
CVE-2025-55150 CVE record

CVSS 8.6 High

Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf
- Stirling-Tools Stirling-PDF
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2025
CVE-2025-55151 CVE record

CVSS 8.6 High

Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf
- Stirling-Tools Stirling-PDF
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2025
CVE-2025-25235 CVE record

CVSS 8.6 High

Omnissa Secure Email Gateway (SEG) updates address Server-Side Request Forgery (SSRF) vulnerability
- Omnissa Secure Email Gateway
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2025
CVE-2025-25229 CVE record

CVSS 5.4 Medium

Server-side request forgery in Omnissa Workspace ONE UEM
- Omnissa Workspace ONE UEM
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2025
github.com/grafana/grafana-infinity-datasource Go

CVSS 5.0 Medium

Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource
- Server-side request forgery (SSRF)
<1.4.2-0.20250731100004-9c736aa21b3a · fixed in 1.4.2-0.20250731100004-9c736aa21b3a

GHSA-3c93-92r7-j934 · CVE-2025-8341 Not analysed yet 11 Aug 2025
CVE-2025-8772 CVE record

CVSS 5.3 Medium

Vinades NukeViet Module index.php server-side request forgery
- Vinades NukeViet
- Server-side request forgery (SSRF)
Not analysed yet 9 Aug 2025
com.liferay.portal:release.dxp.bom +1 Maven

CVSS 5.1 Medium

Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=2025.Q1.0, <2025.Q1.6 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92 · fixed in 2025.Q1.6, 2024.Q1.16

GHSA-c6g5-g6r7-q4j6 · CVE-2025-4655 Not analysed yet 9 Aug 2025
com.liferay.portal:release.dxp.bom +1 Maven

CVSS 5.3 Medium

Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=2025.Q1.0, <2025.Q1.5 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92 · fixed in 2025.Q1.5, 2024.Q1.16

GHSA-6v93-frf9-2rp8 · CVE-2025-4581 Not analysed yet 9 Aug 2025
CVE-2025-53767 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Azure OpenAI Elevation of Privilege Vulnerability
- Microsoft Azure Open AI
- Server-side request forgery (SSRF)
Not analysed yet 7 Aug 2025
CVE-2025-51058 CVE record

CVSS 6.5 Medium

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP req…
- Server-side request forgery (SSRF)
Not analysed yet 6 Aug 2025
CVE-2025-50234 CVE record

CVSS 6.5 Medium

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.
- Server-side request forgery (SSRF)
Not analysed yet 6 Aug 2025
CVE-2024-55399 CVE record

CVSS 6.5 Medium

4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).
- Server-side request forgery (SSRF)
Not analysed yet 6 Aug 2025
CVE-2025-8529 CVE record

CVSS 5.3 Medium

cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery
- cloudfavorites favorites-web
- Server-side request forgery (SSRF)
Not analysed yet 4 Aug 2025
CVE-2025-8527 CVE record

CVSS 5.3 Medium

Exrick xboot Swagger SecurityController.java server-side request forgery
- Exrick xboot
- Server-side request forgery (SSRF)
Not analysed yet 4 Aug 2025
CVE-2025-8520 CVE record

CVSS 5.1 Medium

givanz Vvveb Drag-and-Drop Editor editor server-side request forgery
- givanz Vvveb
- Server-side request forgery (SSRF)
Not analysed yet 4 Aug 2025
CVE-2025-54132 CVE record

CVSS 4.4 Medium

Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch
- cursor
- Server-side request forgery (SSRF)
Not analysed yet 1 Aug 2025
CVE-2025-52567 CVE record

CVSS 3.5 Low

GLPI has overly permissive URL verification
- glpi
- Server-side request forgery (SSRF)
Not analysed yet 30 Jul 2025
bentoml PyPI

CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

BentoML SSRF Vulnerability in File Upload Processing
- Server-side request forgery (SSRF)
>=1.4.0, <1.4.19 · fixed in 1.4.19

GHSA-mrmq-3q62-6cc8 · CVE-2025-54381 Not analysed yet 29 Jul 2025
webfinger.js npm

CVSS 6.9 Medium

webfinger.js Blind SSRF Vulnerability
- Server-side request forgery (SSRF)
<2.8.1 · fixed in 2.8.1

GHSA-8xq3-w9fx-74rv · CVE-2025-54590 Not analysed yet 28 Jul 2025
CVE-2025-24485 CVE record

CVSS 5.8 Medium

Server-side request forgery in MedDream PACS Premium
- MedDream PACS Premium
- Server-side request forgery (SSRF)
Not analysed yet 28 Jul 2025
ssrfcheck npm

CVSS 8.2 High

Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability
- Server-side request forgery (SSRF)
<1.2.0 · fixed in 1.2.0

GHSA-c2fv-2fmj-9xrx Withdrawn Not analysed yet 28 Jul 2025
CVE-2025-8228 CVE record

CVSS 5.3 Medium

yanyutao0402 ChanCMS getPages server-side request forgery
- yanyutao0402 ChanCMS
- Server-side request forgery (SSRF)
Not analysed yet 27 Jul 2025
CVE-2025-52455 CVE record

CVSS 5.3 Medium

Server-side request forgery in Salesforce Tableau Server
- Salesforce Tableau Server
- Server-side request forgery (SSRF)
Not analysed yet 25 Jul 2025
CVE-2025-52454 CVE record

CVSS 8.2 High

Server-side request forgery in Salesforce Tableau Server
- Salesforce Tableau Server
- Server-side request forgery (SSRF)
Not analysed yet 25 Jul 2025
CVE-2025-52453 CVE record

CVSS 8.2 High

Server-side request forgery in Salesforce Tableau Server
- Salesforce Tableau Server
- Server-side request forgery (SSRF)
Not analysed yet 25 Jul 2025
CVE-2025-8133 CVE record

CVSS 5.3 Medium

yanyutao0402 ChanCMS gather.js getArticle server-side request forgery
- yanyutao0402 ChanCMS
- Server-side request forgery (SSRF)
Not analysed yet 25 Jul 2025
CVE-2025-45939 CVE record

CVSS 6.5 Medium

Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.
- Server-side request forgery (SSRF)
Not analysed yet 25 Jul 2025
private-ip npm

CVSS 8.8 High

private-ip vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=3.0.2 · no fixed version yet

GHSA-9h3q-32c7-r533 · CVE-2025-8020 Not analysed yet 23 Jul 2025
CVE-2025-5818 CVE record

CVSS 5.5 Medium

Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery
- krasenslavov Featured Image Plus – Bulk Edit Featured Images, Unsplash & Alt Text Manager
- Server-side request forgery (SSRF)
Not analysed yet 23 Jul 2025
CVE-2025-54122 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint
- Manager
- Server-side request forgery (SSRF)
Not analysed yet 21 Jul 2025
CVE-2025-52362 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior.
- Server-side request forgery (SSRF)
Not analysed yet 21 Jul 2025
CVE-2025-36845 CVE record

CVSS 8.6 High

An issue was discovered in Eveo URVE Web Manager 27.02.2025.
- Server-side request forgery (SSRF)
Not analysed yet 21 Jul 2025
CVE-2025-46385 CVE record

CVSS 8.6 High

Server-side request forgery in Emby Windows
- Emby Windows
- Server-side request forgery (SSRF)
Not analysed yet 20 Jul 2025
com.xuxueli:xxl-job-core Maven

CVSS 5.3 Medium

XXL-JOB is vulnerable to SSRF attacks
- Server-side request forgery (SSRF)
<=3.1.1 · no fixed version yet

GHSA-f8vw-8vgh-22r9 · CVE-2025-7787 Not analysed yet 18 Jul 2025
CVE-2025-52163 CVE record

CVSS 6.5 Medium

A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary intern…
- Server-side request forgery (SSRF)
Not analysed yet 18 Jul 2025
CVE-2025-7759 CVE record

CVSS 5.3 Medium

thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgery
- thinkgem JeeSite
- Server-side request forgery (SSRF)
Not analysed yet 17 Jul 2025
CVE-2025-20288 CVE record

CVSS 5.8 Medium

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability
- Cisco Unified Contact Center Express
- Cisco Unified Intelligence Center
- Server-side request forgery (SSRF)
Not analysed yet 16 Jul 2025
org.glassfish.main.admingui:console-common Maven

CVSS 8.9 High

Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
- Server-side request forgery (SSRF)
<=6.2.5 · no fixed version yet

GHSA-f7h5-c625-3795 · CVE-2024-9408 Not analysed yet 16 Jul 2025
CVE-2025-48294 CVE record

CVSS 4.4 Medium

WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability
- Kerfred FG Drupal to WordPress
- Server-side request forgery (SSRF)
Not analysed yet 16 Jul 2025
CVE-2025-1220 CVE record

CVSS 3.7 Low

Null byte termination in hostnames
- PHP
- Server-side request forgery (SSRF)
Not analysed yet 13 Jul 2025
CVE-2025-53641 CVE record

CVSS 8.2 High

Postiz allows header mutation in middleware facilitates resulting in SSRF
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
Not analysed yet 11 Jul 2025
CVE-2025-50125 CVE record

CVSS 6.3 Medium

Server-side request forgery in Schneider Electric EcoStruxure™ IT Data Center Expert
- Schneider Electric EcoStruxure™ IT Data Center Expert
- Server-side request forgery (SSRF)
Not analysed yet 11 Jul 2025
CVE-2025-6851 CVE record

CVSS 7.2 High

Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery
- apos37 Broken Link Notifier
- Server-side request forgery (SSRF)
Not analysed yet 11 Jul 2025
CVE-2025-51591 CVE record

CVSS 3.7 Low

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe.
- Server-side request forgery (SSRF)
Not analysed yet 11 Jul 2025
CVE-2025-53371 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs
- miraheze DiscordNotifications
- Denial of service
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2025
CVE-2024-43394 CVE record

CVSS 7.5 High

Apache HTTP Server: SSRF on Windows due to UNC paths
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2025
CVE-2024-43204 CVE record

CVSS 7.5 High

Apache HTTP Server: SSRF with mod_headers setting Content-Type header
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2025
CVE-2025-49545 CVE record

CVSS 6.2 Medium

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion
- Server-side request forgery (SSRF)
Not analysed yet 8 Jul 2025
CVE-2025-0292 CVE record

CVSS 5.5 Medium

Server-side request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Server-side request forgery (SSRF)
Not analysed yet 8 Jul 2025
CVE-2025-42965 CVE record

CVSS 4.1 Medium

Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application
- SAP_SE SAP BusinessObjects BI Platform Central Management Console Promotion Management Application
- Server-side request forgery (SSRF)
Not analysed yet 8 Jul 2025
CVE-2025-53473 CVE record

CVSS 6.9 Medium

Server-side request forgery in Nimesa Backup and Recovery
- Nimesa Backup and Recovery
- Server-side request forgery (SSRF)
Not analysed yet 7 Jul 2025
CVE-2025-7103 CVE record

CVSS 5.3 Medium

BoyunCMS curl Index.php server-side request forgery
- BoyunCMS
- Server-side request forgery (SSRF)
Not analysed yet 7 Jul 2025
CVE-2025-49418 CVE record

CVSS 7.2 High

WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability
- TeconceTheme Allmart
- Server-side request forgery (SSRF)
Not analysed yet 4 Jul 2025
CVE-2025-28963 CVE record

CVSS 5.4 Medium

WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability
- Md Yeasin Ul Haider URL Shortener
- Server-side request forgery (SSRF)
Not analysed yet 4 Jul 2025
CVE-2025-6729 CVE record

CVSS 6.4 Medium

PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
- qazomardok PayMaster for WooCommerce
- Server-side request forgery (SSRF)
Not analysed yet 4 Jul 2025
CVE-2025-5817 CVE record

CVSS 7.2 High

Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
- suhailahmad64 Amazon Products to WooCommerce
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2025
CVE-2025-34051 CVE record

CVSS 6.9 Medium

AVTECH DVR Devices Server-Side Request Forgery
- AVTECH DVR devices
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 1 Jul 2025