Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.6 CriticalCritical · CVSS 9+
A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API.
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
- Server-side request forgery (SSRF)
>=19.0.0-next.0, <19.2.18 || >=20.0.0-next.0, <20.3.6 || >=21.0.0-next.0, <21.0.0-next.8 · fixed in 19.2.18, 20.3.6, 21.0.0-next.8
GHSA-q63q-pgmf-mxhr · CVE-2025-62427 - CVSS 6.9 Medium
NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery
- Nucleoid
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery
- miunosoft Task Scheduler
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
PiExtract｜SOOP-CLM - Server-Side Request Forgery
- PiExtract SOOP-CLM
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgery
- Tomofun Furbo 360
- Tomofun Furbo Mini
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Tomofun Furbo 360 Account server-side request forgery
- Tomofun Furbo 360
- Server-side request forgery (SSRF)
- CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware
Server-side request forgery in Oracle Corporation Oracle Configurator
- Oracle Corporation Oracle Configurator
- Path traversal
- Other injection
- CVSS 3.5 Low
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF)
- HCL Software Unica Centralized Offer Management
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery
- rico-macchi WP Scraper
- Server-side request forgery (SSRF)
- CVSS 8.5 High
New API has Authenticated Server-Side Request Forgery (SSRF) issue
- QuantumNous new-api
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin
- Sonatype Nexus Repository
- Server-side request forgery (SSRF)
- CVSS 7.1 High
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class
- Open redirect
- Server-side request forgery (SSRF)
>=0.5.0, <0.11.0 · fixed in 0.11.0
GHSA-3f6c-7fw2-ppm4 · CVE-2025-6242 - CVSS 7.6 High
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
- Path traversal
- Server-side request forgery (SSRF)
<0.9.4 · fixed in 0.9.4
GHSA-527m-2xhr-j27g · CVE-2025-61784 - CVSS 5.1 Medium
Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload
- xuemian168 kuno
- Unrestricted file upload
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
- samanhappy MCPHub
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints
- OpenSupports
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via t…
- Server-side request forgery (SSRF)
- CVSS 1.8 Low
Server-side request forgery in Secure Access
- Absolute Security Secure Access
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability
- Server-side request forgery (SSRF)
>=4.0.0, <5.0.3 · fixed in 5.0.3
GHSA-f6m8-qm7j-fh65 · CVE-2025-61735 - CVSS 6.5 Medium
VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise
- Splunk Enterprise
- Splunk Cloud Platform
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery
- bplugins Block for Mailchimp – Add Email Subscription Forms and Collect Leads
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Vasion Print (formerly PrinterLogic) SSRF via console_release Directory
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php
- Vasion Print Virtual Appliance Host
- Vasion Print Application
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Tencent WeKnora test testEmbeddingModel server-side request forgery
- Tencent WeKnora
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability
- Silencesoft RSS Reader
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability
- bdthemes ZoloBlocks
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery
- inc2734 Snow Monkey
- Server-side request forgery (SSRF)
- CVSS 9.5 CriticalCritical · CVSS 9+
cors-anywhere vulnerable to server-side request forgery
- Server-side request forgery (SSRF)
- CWE-942
<=0.4.4 · no fixed version yet
GHSA-r3jv-xfgx-gj24 · CVE-2020-36851 - CVSS 5.5 Medium
Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
- Server-side request forgery (SSRF)
<2.1.0 · fixed in 2.1.0
GHSA-g2rq-jv54-wcpr · CVE-2025-59346 - CVSS 4.3 Medium
Server-Side Request Forgery in SAP BI Platform
- SAP_SE SAP BI Platform
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
is-localhost-ip 2.0.0 - SSRF via Restrictions bypass
- is-localhost-ip
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability
- Publitio
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability
- activewebsight SEO Backlink Monitor
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability
- Binsaifullah Beaf
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability
- Skimlinks Affiliate Marketing Tool
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability
- Pratik Ghela MakeStories (for Google Web Stories)
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability
- SmartDataSoft DriCub
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability
- Alex Content Mask
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
IBM webMethods Integration server-side request forgery
- IBM webMethods Integration
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MuYuCMS Add Fiend Link index.html server-side request forgery
- MuYuCMS
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery
- SeriaWei ZKEACMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery
- SeriaWei ZKEACMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Harness lookup_repo.go LookupRepo server-side request forgery
- Harness
- Server-side request forgery (SSRF)
- CVSS 7.5 High
CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- NetApp StorageGRID
- Server-side request forgery (SSRF)
- CVSS 7.7 High
AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction
- aliasvault
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature.
- Path traversal
- Code injection
- CVSS 6.5 Medium
WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.
- Server-side request forgery (SSRF)
- CVSS 3.2 Low
Server-side request forgery in fedorindutny ip
- fedorindutny ip
- Server-side request forgery (SSRF)
- CVSS 3.2 Low
Server-side request forgery in fedorindutny ip
- fedorindutny ip
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
>=1.4.0, <1.5.0 · fixed in 1.5.0
GHSA-g5cg-6c7v-mmpw · CVE-2025-59155 - CVSS 6.1 Medium
Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark
- Server-side request forgery (SSRF)
>=5.99.0, <5.130.4 || >=6.0.0, <6.0.9 · fixed in 5.130.4, 6.0.9
GHSA-f7qg-xj45-w956 · CVE-2025-9862