CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,137 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 35 of 83

CVE-2019-15728HIGHCVSS 7.5EG 7.5
2019-09-16
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network reso…
CVE-2019-12633HIGHCVSS 7.5EG 7.5
2019-09-05
A vulnerability in Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. The vulnerability…
CVE-2019-12632HIGHCVSS 7.5EG 7.5
2019-09-05
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on an affected system. The vulnerability exists because the affected system …
CVE-2019-9187HIGHCVSS 7.5EG 7.5
2019-06-05
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
CVE-2019-6970HIGHCVSS 7.5EG 7.5
2019-03-21
Moodle 3.5.x before 3.5.4 allows SSRF.
CVE-2017-3164HIGHCVSS 7.5EG 7.5
2019-03-08
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET…
CVE-2019-5725HIGHCVSS 7.5EG 7.5
2019-01-08
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file.
CVE-2018-15895HIGHCVSS 7.5EG 7.5
2018-08-27
An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in…
CVE-2018-14858HIGHCVSS 7.5EG 7.5
2018-08-02
An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists be…
CVE-2018-5004HIGHCVSS 7.5EG 7.5
2018-07-20
Adobe Experience Manager versions 6.2 and 6.3 have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-12809HIGHCVSS 7.5EG 7.5
2018-07-20
Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2017-0929HIGHCVSS 7.5EG 7.5
2018-07-03
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
CVE-2018-7055HIGHCVSS 7.5EG 7.5
2018-02-15
GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.
CVE-2018-6029HIGHCVSS 7.5EG 7.5
2018-01-23
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only con…
CVE-2017-1000419HIGHCVSS 7.5EG 7.5
2018-01-02
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
CVE-2017-4928HIGHCVSS 7.5EG 7.5
2017-11-17
The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these i…
CVE-2023-6294HIGHCVSS 7.2EG 7.5
2024-02-12
The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
CVE-2023-42439HIGHCVSS 6.5EG 7.5
2023-09-15
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user …
CVE-2023-27896HIGHCVSS 6.5EG 7.5
2023-03-14
In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.
CVE-2023-27271HIGHCVSS 6.5EG 7.5
2023-03-14
In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availab…
CVE-2021-40186HIGHCVSS 6.5EG 7.5
2022-06-02
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network reques…
CVE-2022-0528HIGHCVSS 6.5EG 7.5
2022-03-03
Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
CVE-2026-3588HIGHCVSS 5.5EG 7.5
2026-03-09
A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.
CVE-2025-8267HIGHCVSS 5.3EG 7.5
2025-07-28
Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (…
CVE-2026-112308HIGHCVSS 7.4EG 7.4
2026-10-19
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influenc…
CVE-2026-107781HIGHCVSS 7.4EG 7.4
2026-10-08
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can s…
CVE-2026-82375HIGHCVSS 7.4EG 7.4
2026-09-28
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclos…
CVE-2026-81446HIGHCVSS 7.4EG 7.4
2026-09-17
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-s…
CVE-2026-18730HIGHCVSS 7.4EG 7.4
2026-09-01
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthentic…
CVE-2026-82289HIGHCVSS 7.4EG 7.4
2026-08-28
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostna…
CVE-2026-10582HIGHCVSS 7.4EG 7.4
2026-08-24
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and t…
CVE-2026-70666HIGHCVSS 7.4EG 7.4
2026-08-18
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME d…
CVE-2026-50236HIGHCVSS 7.4EG 7.4
2026-08-11
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full respon…
CVE-2026-50237HIGHCVSS 7.4EG 7.4
2026-08-11
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing …
CVE-2026-54660HIGHCVSS 7.4EG 7.4
2026-07-29
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDo…
CVE-2026-62240HIGHCVSS 7.4EG 7.4
2026-07-13
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the securit…
CVE-2026-49969HIGHCVSS 7.4EG 7.4
2026-07-13
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUp…
CVE-2026-53450HIGHCVSS 7.4EG 7.4
2026-07-10
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped …
CVE-2026-56676HIGHCVSS 7.4EG 7.4
2026-07-10
9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution.…
CVE-2026-59806HIGHCVSS 7.4EG 7.4
2026-07-08
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch()…
CVE-2026-57993HIGHCVSS 7.4EG 7.4
2026-07-03
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-49857HIGHCVSS 7.4EG 7.4
2026-07-01
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. Howe…
CVE-2026-12992HIGHCVSS 7.4EG 7.4
2026-06-25
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a …
CVE-2026-53782HIGHCVSS 7.4EG 7.4
2026-06-11
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 privat…
CVE-2026-48555HIGHCVSS 7.4EG 7.4
2026-05-29
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addM…
CVE-2026-45310HIGHCVSS 7.4EG 7.4
2026-05-28
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal se…
CVE-2026-45373HIGHCVSS 7.4EG 7.4
2026-05-28
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do no…
CVE-2026-45245HIGHCVSS 7.4EG 7.4
2026-05-18
Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests …
CVE-2026-34647HIGHCVSS 7.4EG 7.4
2026-05-12
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could lever…
CVE-2026-39418HIGHCVSS 7.4EG 7.4
2026-04-14
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto() with the MSG_FASTOPEN flag. This allows authenticated user with tool-editing permissions …

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →