A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any …

CVE-2021-40186MEDIUMCVSS 6.5EG 7.5

2022-06-02

The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network reques…

CVE-2021-40438CRITICALCVSS 9.0EG 9.0⚠ KEV

2021-09-16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-40537LOWCVSS 2.7EG 2.7

2021-09-08

Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.

CVE-2021-40604CRITICALCVSS 9.1EG 9.1

2022-06-13

A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In som…

CVE-2021-4075HIGHCVSS 7.2EG 7.2

2021-12-06

snipe-it is vulnerable to Server-Side Request Forgery (SSRF)

CVE-2021-40809HIGHCVSS 8.8EG 8.8

2021-12-01

An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.

CVE-2021-40822HIGHCVSS 7.5EG 7.5

2022-05-02

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

CVE-2021-41084HIGHCVSS 8.7EG 8.7

2021-09-21

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.…

CVE-2021-41385MEDIUMCVSS 6.5EG 6.5

2021-09-27

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details via SSRF.

CVE-2021-41403CRITICALCVSS 9.8EG 9.8

2022-06-15

flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.

CVE-2021-41586HIGHCVSS 7.5EG 7.5

2021-09-24

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.

CVE-2021-41587HIGHCVSS 7.5EG 7.5

2021-09-24

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.

CVE-2021-41792MEDIUMCVSS 5.3EG 5.3

2021-10-21

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformati…

CVE-2021-41809LOWCVSS 3.5EG 4.3

2022-01-18

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities.

CVE-2021-42079MEDIUMCVSS 6.2EG 6.2

2023-07-10

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET /qstorapi/alertConfigSet?senderEmailAd…

CVE-2021-42091CRITICALCVSS 9.1EG 9.1

2021-10-07

An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.

CVE-2021-42637CRITICALCVSS 9.8EG 9.8

2022-02-02

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerability.

CVE-2021-43293MEDIUMCVSS 4.3EG 4.3

2021-11-04

Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

CVE-2021-43296HIGHCVSS 7.5EG 7.5

2021-11-30

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.

CVE-2021-43449HIGHCVSS 8.1EG 8.1

2023-01-23

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.

CVE-2021-43562HIGHCVSS 8.8EG 8.8

2021-11-10

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can …

CVE-2021-43780MEDIUMCVSS 6.8EG 6.8

2021-11-24

Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vuln…

CVE-2021-43954MEDIUMCVSS 4.3EG 4.3

2022-03-14

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-S…

CVE-2021-43959MEDIUMCVSS 5.7EG 5.7

2022-07-26

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV import…

CVE-2021-44139HIGHCVSS 7.5EG 7.5

2022-03-23

Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).

CVE-2021-44659CRITICALCVSS 9.8EG 9.8

2021-12-22

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF). NOTE: the vendor's position is that the observed behavior is…

CVE-2021-45325HIGHCVSS 7.5EG 7.5

2022-02-08

Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

CVE-2021-45394HIGHCVSS 8.8EG 8.8

2022-01-18

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.

CVE-2021-45851HIGHCVSS 7.5EG 7.5

2022-03-16

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing command…

CVE-2021-45967CRITICALCVSS 9.8EG 9.8

2022-03-18

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.

CVE-2021-45968HIGHCVSS 7.5EG 9.0

2022-03-18

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a …

CVE-2021-46107HIGHCVSS 7.5EG 7.5

2022-03-17

Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.

CVE-2021-47703HIGHCVSS 7.2EG 7.2

2025-12-09

OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through the affected application, allowing hijacking of current sess…

CVE-2021-47715MEDIUMCVSS 5.3EG 5.3

2025-12-22

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST …

CVE-2021-47776MEDIUMCVSS 5.3EG 5.3

2026-01-15

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHe…

CVE-2021-47958MEDIUMCVSS 4.3EG 4.3

2026-05-15

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references …

CVE-2022-0085MEDIUMCVSS 5.3EG 5.3

2022-06-28

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.

CVE-2022-0086CRITICALCVSS 9.8EG 9.8

2022-01-04

uppy is vulnerable to Server-Side Request Forgery (SSRF)

CVE-2022-0132HIGHCVSS 7.5EG 7.5

2022-01-10

peertube is vulnerable to Server-Side Request Forgery (SSRF)

CVE-2022-0136MEDIUMCVSS 5.4EG 8.1

2022-03-28

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.

CVE-2022-0249LOWCVSS 3.1EG 9.1

2022-03-28

A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.

CVE-2022-0339CRITICALCVSS 9.8EG 9.8

2022-01-30

Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

CVE-2022-0425MEDIUMCVSS 5.4EG 7.6

2022-04-01

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

CVE-2022-0508MEDIUMCVSS 5.3EG 5.3

2022-02-08

Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832

CVE-2022-0528MEDIUMCVSS 6.5EG 6.5

2022-03-03

Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.

CVE-2022-0591CRITICALCVSS 9.1EG 9.1

2022-03-21

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

CVE-2022-0671CRITICALCVSS 9.1EG 9.1

2022-02-18

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

CVE-2022-0766CRITICALCVSS 9.8EG 9.8

2022-03-07

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVE-2022-0767CRITICALCVSS 9.9EG 9.9

2022-03-07

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CWE-918— Server-Side Request Forgery (SSRF)

CVEs classified under CWE-918page 11 of 48

Map vulnerabilities like CWE-918 to your infrastructure