CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,281 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 11 of 86

CVE-2025-65836CRITICALCVSS 9.1EG 9.1
2025-12-01
PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.
CVE-2025-34282CRITICALCVSS 9.1EG 9.1
2025-10-17
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the …
CVE-2025-57644CRITICALCVSS 9.1EG 9.1
2025-09-19
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, i…
CVE-2025-44594CRITICALCVSS 9.1EG 9.1
2025-09-09
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
CVE-2025-27217CRITICALCVSS 9.1EG 9.1
2025-08-21
A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.
CVE-2025-50251CRITICALCVSS 9.1EG 9.1
2025-08-13
Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.
CVE-2025-52362CRITICALCVSS 9.1EG 9.1
2025-07-21
Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to…
CVE-2025-53371CRITICALCVSS 9.1EG 9.1
2025-07-10
DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncom…
CVE-2025-6087CRITICALCVSS 9.1EG 9.1
2025-06-16
A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to …
CVE-2025-4967CRITICALCVSS 9.1EG 9.1
2025-05-29
Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.
CVE-2024-6584CRITICALCVSS 9.1EG 9.1
2025-05-15
The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
CVE-2025-45887CRITICALCVSS 9.1EG 9.1
2025-05-09
Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
CVE-2025-47733CRITICALCVSS 9.1EG 9.1
2025-05-08
Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
CVE-2025-28197CRITICALCVSS 9.1EG 9.1
2025-04-18
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
CVE-2025-28091CRITICALCVSS 9.1EG 9.1
2025-03-28
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
CVE-2025-28090CRITICALCVSS 9.1EG 9.1
2025-03-28
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
CVE-2025-28089CRITICALCVSS 9.1EG 9.1
2025-03-28
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
CVE-2025-25785CRITICALCVSS 9.1EG 9.1
2025-02-26
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
CVE-2024-45479CRITICALCVSS 9.1EG 9.1
2025-01-21
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
CVE-2024-54819CRITICALCVSS 9.1EG 9.1
2025-01-07
I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php
CVE-2024-47578CRITICALCVSS 9.1EG 9.1
2024-12-10
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attack…
CVE-2023-50913CRITICALCVSS 9.1EG 9.1
2024-12-05
Oxide control plane software before 5 allows SSRF.
CVE-2024-50811CRITICALCVSS 9.1EG 9.1
2024-11-08
hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not securely filter user input through push_urls() and get_urls().
CVE-2024-47883CRITICALCVSS 9.1EG 9.1
2024-10-24
The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected to be) local resource files, like images or templates. This…
CVE-2024-38109CRITICALCVSS 9.1EG 9.1
2024-08-13
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
CVE-2024-29736CRITICALCVSS 9.1EG 9.1
2024-07-19
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is conf…
CVE-2024-36675CRITICALCVSS 9.1EG 9.1
2024-06-04
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
CVE-2024-4399CRITICALCVSS 9.1EG 9.1
2024-05-23
The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
CVE-2024-25738CRITICALCVSS 9.1EG 9.1
2024-05-22
A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the adminis…
CVE-2024-34365CRITICALCVSS 9.1EG 9.1
2024-05-14
** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. User…
CVE-2024-31461CRITICALCVSS 9.1EG 9.1
2024-04-10
Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, poten…
CVE-2024-25864CRITICALCVSS 9.1EG 9.1
2024-04-03
Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the fpostit.php component.
CVE-2024-25294CRITICALCVSS 9.1EG 9.1
2024-03-20
An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.
CVE-2023-49785CRITICALCVSS 9.1EG 9.1
2024-03-12
NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read acces…
CVE-2024-22205CRITICALCVSS 9.1EG 9.1
2024-01-23
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on line…
CVE-2024-22203CRITICALCVSS 9.1EG 9.1
2024-01-23
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which …
CVE-2023-50731CRITICALCVSS 9.1EG 9.1
2023-12-22
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, wh…
CVE-2023-48023CRITICALCVSS 9.1EG 9.1
2023-11-28
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
CVE-2023-41054CRITICALCVSS 9.1EG 9.1
2023-09-04
LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `image_proxy.php` file of LibreY before commit 8f9b9803f…
CVE-2022-42183CRITICALCVSS 9.1EG 9.1
2023-07-31
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2023-27162CRITICALCVSS 9.1EG 9.1
2023-03-31
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a cr…
CVE-2022-45152CRITICALCVSS 9.1EG 9.1
2022-11-25
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which …
CVE-2022-40842CRITICALCVSS 9.1EG 9.1
2022-11-22
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.
CVE-2022-41477CRITICALCVSS 9.1EG 9.1
2022-10-14
A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories.
CVE-2022-2900CRITICALCVSS 9.1EG 9.1
2022-09-14
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
CVE-2022-25801CRITICALCVSS 9.1EG 9.1
2022-07-14
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
CVE-2022-25800CRITICALCVSS 9.1EG 9.1
2022-07-14
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
CVE-2021-40604CRITICALCVSS 9.1EG 9.1
2022-06-13
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In som…
CVE-2022-31830CRITICALCVSS 9.1EG 9.1
2022-06-09
Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
CVE-2022-31827CRITICALCVSS 9.1EG 9.1
2022-06-09
MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →