Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.7 High
Emlog vulnerable to Server-Side Request Forgery (SSRF)
- emlog
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery
- sonic
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
- smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerability
- extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability
- Jthemes Genemy
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
EyouCMS function.php saveRemote server-side request forgery
- EyouCMS
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
FeehiCMS TimThumb timthumb.php server-side request forgery
- FeehiCMS
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability
- Youzify
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
hemmelig allows SSRF Filter bypass via Secret Request functionality
- Server-side request forgery (SSRF)
<7.3.3 · fixed in 7.3.3
GHSA-vvxf-wj5w-6gj5 · CVE-2025-69206 - CVSS 4.9 Medium
WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability
- HETWORKS WordPress Image shrinker
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery
- YunaiV yudao-cloud
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings
- Teradek, LLC VidiU Pro
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability
- Yannick Lefebvre Link Library
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability
- 6Storage Rentals
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability
- bdthemes Prime Slider – Addons For Elementor
- Server-side request forgery (SSRF)
- CVSS 7.8 High
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
- Server-side request forgery (SSRF)
<0.24.0 · fixed in 0.24.0
GHSA-hm5p-x4rq-38w4 · CVE-2025-68696 - CVSS 6.3 Medium
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
- Server-side request forgery (SSRF)
>=1.3.0, <1.3.9 · fixed in 1.3.9
GHSA-9c54-gxh7-ppjc · CVE-2025-67743 - CVSS 6.9 Medium
Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
- Hasura GraphQL
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
- Server-side request forgery (SSRF)
<2.9.0 · fixed in 2.9.0
GHSA-83jg-m2pm-4jxj · CVE-2025-34469 - CVSS 7.7 High
Langflow vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<1.7.1 · fixed in 1.7.1
GHSA-5993-7p27-66g5 · CVE-2025-68477 - CVSS 7.2 High
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
- bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Custom Question Answering Elevation of Privilege Vulnerability
- Microsoft Azure Cognitive Service for Language
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write
- Streama
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery
- bdthemes Prime Slider – Addons for Elementor
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
- Server-side request forgery (SSRF)
<8.6.2 || >=9.0.0, <9.1.1-alpha.1 · fixed in 8.6.2, 9.1.1-alpha.1
GHSA-3f5f-xgrj-97pf · CVE-2025-68150 - CVSS 5.1 Medium
PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection
- PodcastGenerator
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References
- Server-side request forgery (SSRF)
<=0.0.0-alpha.0.0.20260130163947-0eb84cd66658 · no fixed version yet
GHSA-gxvv-45f6-3ch8 · CVE-2025-14443 - CVSS 5.4 Medium
WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability
- LMPixels Kerge
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an…
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Ateme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability
- Ateme TITAN
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Grav may be vulnerable to SSRF attack via Twig Templates
- Server-side request forgery (SSRF)
<=1.7.49.5 · no fixed version yet
GHSA-729w-j79f-2c34 · CVE-2025-66844 - CVSS 5.8 Medium
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
- Server-side request forgery (SSRF)
<1.32.10 || >=1.33.0-alpha.0, <1.33.6 || >=1.34.0-alpha.0, <1.34.2 · fixed in 1.32.10, 1.33.6, 1.34.2
GHSA-r6j8-c6r2-37rr · CVE-2025-13281 - CVSS 4.4 Medium
Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery
- Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
PowerJob has a server-side request forgery vulnerability in PingPongUtils.java
- Server-side request forgery (SSRF)
<=5.1.2 · no fixed version yet
GHSA-8xqm-6fj2-hfgf · CVE-2025-14518 - CVSS 5.3 Medium
Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery
- Yalantis uCrop
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery
- themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF
- BrightSign, LLC BrightSign Digital Signage Diagnostic Web Server
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
<=1.0.2 · no fixed version yet
GHSA-8fxj-2g9q-8fjw · CVE-2025-65513 - CVSS 7.5 High
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before.
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php
- OPEN BMCS OpenBMCS
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
JDA (Java Discord API) downloads external URLs when updating message components
- Server-side request forgery (SSRF)
>=6.0.0, <6.1.3 · fixed in 6.1.3
GHSA-93fv-4pm9-xp28 - CVSS 4.9 Medium
WordPress Hercules Core plugin <= 7.4 - Server Side Request Forgery (SSRF) vulnerability
- ThemesInflow Hercules Core
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- Server-side request forgery (SSRF)
<1.80.0-v2.20.0.20251208091519-4c879b47334e || >=1.83.4, <=1.87.5 || >=4.0.0-rc.1, <4.7.1 · fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
GHSA-7wfc-4796-gmg5 · CVE-2025-67494 - CVSS 4.6 Medium
IBM InfoSphere Information Server Server-Side Request Forgery
- IBM InfoSphere Information Server
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9
- Infinera MTC-9
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery
- xerrors Yuxi-Know
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
- Apache Software Foundation Apache HTTP Server
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
- Server-side request forgery (SSRF)
<0.6.37 · fixed in 0.6.37
GHSA-c6xv-rcvw-v685 · CVE-2025-65958 - CVSS 5.1 Medium
dayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7e.php server-side request forgery
- dayrui XunRuiCMS
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
dayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgery
- dayrui XunRuiCMS
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise
- Splunk Enterprise
- Splunk Cloud Platform
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio
- ObjectPlanet Opinio
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
- Server-side request forgery (SSRF)
<1.14.0 · fixed in 1.14.0
GHSA-hhh5-2cvx-vmfp · CVE-2025-66405 - CVSS 6.8 Medium
Frontend arbitrary file read in oauth.authorize action
- Zabbix
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery
- moxi159753 Mogu Blog v2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery
- orionsec orion-ops
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery
- deco-cx apps
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
ZenTao model.php makeRequest server-side request forgery
- ZenTao
- Server-side request forgery (SSRF)