Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
>=3.0.5, <3.0.6 · fixed in 3.0.6
GHSA-hr92-4q35-4j3m · CVE-2025-59527 - CVSS 5.3 Medium
ZKEACMS MediaController.cs Proxy server-side request forgery
- ZKEACMS
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter
- dataease
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
PilotGaea Technologies｜O'View MapServer - Server-Side Request Forgery
- PilotGaea Technologies O'View MapServer
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SourceCodester Link Status Checker index.php server-side request forgery
- SourceCodester Link Status Checker
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Magicblack MacCMS API server-side request forgery
- Magicblack MacCMS
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Magicblack MacCMS Scheduled Task col_url server-side request forgery
- Magicblack MacCMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
miurla morphic HTTP Status Code 3xx advanced-search fetchHtml server-side request forgery
- miurla morphic
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
CRMEB OutAccountServices.php testOutUrl server-side request forgery
- CRMEB
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
cdevroe unmark Marks.php server-side request forgery
- cdevroe unmark
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
InstantCMS vulnerable to Server-Side Request Forgery via package installer
- instantsoft icms2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
yanyutao0402 ChanCMS getArticle CollectController server-side request forgery
- yanyutao0402 ChanCMS
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
- fernandiez Auto Save Remote Images (Drafts)
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-Side Request Forgery (SSRF) vulnerability found in embedded web server
- Lexmark CX, XC, CS, MS, MX, XM, et. al.
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Experience Manager
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress WP eBay Product Feeds Plugin <= 3.4.8 - Server Side Request Forgery (SSRF) Vulnerability
- Rhys Wynne WP eBay Product Feeds
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Shanghai Lingdang Information Technology Lingdang CRM index_event.php server-side request forgery
- Shanghai Lingdang Information Technology Lingdang CRM
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability
- FWDesign Ultimate Video Player
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability
- LiteSpeed Technologies LiteSpeed Cache
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Server-side request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Liferay Portal is vulnerable to SSRF through custom object attachment fields
- Server-side request forgery (SSRF)
<1.0.208 · fixed in 1.0.208
GHSA-477q-x55m-j38g · CVE-2025-43763 - CVSS 9.1 CriticalCritical · CVSS 9+
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SimStudioAI sim route.ts server-side request forgery
- sim
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side Request Forgery (SSRF) vulnerability
- aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter
- Server-side request forgery (SSRF)
>=11.0.3, <12.6.6 · fixed in 12.6.6
GHSA-qpr4-c339-7vq8 · CVE-2025-58179 - CVSS 2.7 Low
Mautic vulnerable to SSRF via webhook function
- Server-side request forgery (SSRF)
>=4.4.0, <4.4.17 || >=5.0.0-alpha, <5.2.8 || >=6.0.0-alpha, <6.0.5 · fixed in 4.4.17, 5.2.8, 6.0.5
GHSA-hj6f-7hp7-xg69 · CVE-2025-9821 - CVSS 5.4 Medium
WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability
- kamleshyadav Exit Intent Popup
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress WP Bannerize Pro Plugin <= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability
- gfazioli WP Bannerize Pro
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SimStudioAI sim route.ts server-side request forgery
- sim
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery
- Langfuse
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
Knowage vulnerable to server-side request forgery
- KnowageLabs Knowage-Server
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Next.js Improper Middleware Redirect Handling Leads to SSRF
- Server-side request forgery (SSRF)
>=0.9.9, <14.2.32 || >=15.0.0-canary.0, <15.4.7 · fixed in 14.2.32, 15.4.7
GHSA-4342-x723-ch2f · CVE-2025-57822 - CVSS 3.5 Low
Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server
- Server-side request forgery (SSRF)
>=10.5.0+incompatible, <10.5.10+incompatible · fixed in 10.5.10+incompatible
GHSA-vqwh-5jhh-vc9p · CVE-2025-47700 - CVSS 6.4 Medium
WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability
- Chartbeat
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerability
- vEnCa-X rajce
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability
- solacewp Solace Extra
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Firecrawl SSRF Vulnerability via malicious webhook
- firecrawl
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1
- Server-side request forgery (SSRF)
<2.0.0 · fixed in 2.0.0
GHSA-pw25-c82r-75mm · CVE-2025-57814 - CVSS 5.1 Medium
kalcaddle kodbox Download from Link serverDownload server-side request forgery
- kalcaddle kodbox
- Server-side request forgery (SSRF)
- CVSS 8.7 High
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
- Server-side request forgery (SSRF)
<1.30.0 || >=2.0.0, <2.1.12 || >=2.2.0, <2.4.0 || >=3.0.0, <3.10.0 || >=4.0.0, <5.0.0 · fixed in 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
GHSA-rx7m-68vc-ppxh · CVE-2025-54370 - CVSS 5.1 Medium
HuangDou UTCMS Config update.php server-side request forgery
- HuangDou UTCMS
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
wangsongyan wblog backup.go RestorePost server-side request forgery
- wangsongyan wblog
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery
- arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Server-side request forgery in Liferay DXP
- Liferay DXP
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Server-side request forgery in Ubiquiti Inc UISP Application
- Ubiquiti Inc UISP Application
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
IBM Edge Application Manager server-side request forgery
- IBM Edge Application Manager
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) and others
- Schneider Electric EcoStruxure™ Power Monitoring Expert (PME)
- Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) and others
- Schneider Electric EcoStruxure™ Power Monitoring Expert (PME)
- Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java
- Server-side request forgery (SSRF)
>=1.6.0-release, <=1.11.0-release · no fixed version yet
GHSA-hf86-8x8v-h7vc · CVE-2024-39954 - CVSS 8.6 High
SSRF in PozitifIK's Pik Online
- Pik Online
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=1.17.0, <1.19.2 · fixed in 1.19.2
GHSA-35c5-67fm-cpcp · CVE-2025-8678 - CVSS 2.7 Low
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095
- Drupal AI SEO Link Advisor
- Server-side request forgery (SSRF)
- CVSS 3.8 Low
Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery
- Quttera ThreatSign – Web Malware Scanner for WordPress
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
- bplugins bSlider – Create Responsive Image, Post, Product, and Video Sliders
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
WordPress Simplified plugin <= 1.0.11 - Server Side Request Forgery (SSRF) vulnerability
- kodeshpa Simplified
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress PressForward <= 5.9.4 - Server Side Request Forgery (SSRF) vulnerability
- PressForward
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.
- Server-side request forgery (SSRF)