CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,145 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 39 of 83

CVE-2026-39728HIGHCVSS 7.2EG 7.2
2026-10-06
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
CVE-2026-39719HIGHCVSS 7.2EG 7.2
2026-10-06
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
CVE-2026-103082HIGHCVSS 7.2EG 7.2
2026-10-01
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
CVE-2026-76728HIGHCVSS 7.2EG 7.2
2026-09-29
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker …
CVE-2026-54544HIGHCVSS 7.2EG 7.2
2026-09-15
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord…
CVE-2026-89242HIGHCVSS 7.2EG 7.2
2026-09-11
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated at…
CVE-2026-81806HIGHCVSS 7.2EG 7.2
2026-09-08
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.
CVE-2026-86539HIGHCVSS 7.2EG 7.2
2026-09-07
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal h…
CVE-2026-84761HIGHCVSS 7.2EG 7.2
2026-09-03
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
CVE-2026-45019HIGHCVSS 7.2EG 7.2
2026-08-25
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint with…
CVE-2026-54794HIGHCVSS 7.2EG 7.2
2026-08-19
Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVE-2026-17565HIGHCVSS 7.2EG 7.2
2026-08-19
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to in…
CVE-2026-32553HIGHCVSS 7.2EG 7.2
2026-08-18
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
CVE-2026-32473HIGHCVSS 7.2EG 7.2
2026-08-18
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
CVE-2026-66704HIGHCVSS 7.2EG 7.2
2026-08-13
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
CVE-2026-69246HIGHCVSS 7.2EG 7.2
2026-08-03
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Hos…
CVE-2026-54605HIGHCVSS 7.2EG 7.2
2026-07-28
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follow…
CVE-2026-65442HIGHCVSS 7.2EG 7.2
2026-07-27
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
CVE-2026-61953HIGHCVSS 7.2EG 7.2
2026-07-27
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
CVE-2026-59552HIGHCVSS 7.2EG 7.2
2026-07-27
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.
CVE-2026-21653HIGHCVSS 7.2EG 7.2
2026-07-23
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
CVE-2026-65516HIGHCVSS 7.2EG 7.2
2026-07-23
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-55372HIGHCVSS 7.2EG 7.2
2026-07-13
NukeViet: Pre-authentication SSRF via X-Forwarded-Host ## Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the `X Forwarded-Host` (and `X-Forwarded-Proto`) reques…
CVE-2026-57407HIGHCVSS 7.2EG 7.2
2026-07-13
Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.
CVE-2026-57372HIGHCVSS 7.2EG 7.2
2026-07-13
Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/a through <= 7.0.
CVE-2026-60091HIGHCVSS 7.2EG 7.2
2026-07-10
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attack…
CVE-2026-57348HIGHCVSS 7.2EG 7.2
2026-07-02
Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.
CVE-2026-44161HIGHCVSS 7.2EG 7.2
2026-06-26
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration pa…
CVE-2026-50189HIGHCVSS 7.2EG 7.2
2026-06-24
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /…
CVE-2026-12100HIGHCVSS 7.2EG 7.2
2026-06-24
The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary loc…
CVE-2026-12095HIGHCVSS 7.2EG 7.2
2026-06-24
The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary…
CVE-2026-57114HIGHCVSS 7.2EG 7.2
2026-06-18
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation bl…
CVE-2026-11395HIGHCVSS 7.2EG 7.2
2026-06-18
The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This makes it possible for unauthenticated attackers to make web requests to arbitra…
CVE-2026-10586HIGHCVSS 7.2EG 7.2
2026-06-04
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. Thi…
CVE-2026-48843HIGHCVSS 7.2EG 7.2
2026-05-25
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to loca…
CVE-2026-20035HIGHCVSS 7.2EG 7.2
2026-05-06
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HT…
CVE-2026-6229HIGHCVSS 7.2EG 7.2
2026-05-02
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which …
CVE-2026-7049HIGHCVSS 7.2EG 7.2
2026-05-02
The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scan_video. This makes it possible for unauthenticated attack…
CVE-2026-42404HIGHCVSS 7.2EG 7.2
2026-05-01
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound reques…
CVE-2026-41170HIGHCVSS 7.2EG 7.2
2026-04-22
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup arc…
CVE-2026-33715HIGHCVSS 7.2EG 7.2
2026-04-14
Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does n…
CVE-2026-40072HIGHCVSS 7.2EG 7.2
2026-04-09
web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts i…
CVE-2026-1343HIGHCVSS 7.2EG 7.2
2026-04-08
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attac…
CVE-2026-35037HIGHCVSS 7.2EG 7.2
2026-04-06
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it …
CVE-2026-5469HIGHCVSS 7.2EG 7.2
2026-04-03
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The ven…
CVE-2026-0686HIGHCVSS 7.2EG 7.2
2026-04-02
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthentica…
CVE-2025-12886HIGHCVSS 7.2EG 7.2
2026-03-28
The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web reques…
CVE-2026-3478HIGHCVSS 7.2EG 7.2
2026-03-21
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy end…
CVE-2026-1648HIGHCVSS 7.2EG 7.2
2026-03-21
The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6. This is due to insufficient validation of the 'url' parameter in the '/wp-json/performance-monitor/v1/cu…
CVE-2026-4302HIGHCVSS 7.2EG 7.2
2026-03-21
The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due to the plugin exposing a publicly accessible REST API endpoint (optn/v1/integrat…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →