CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,145 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 41 of 83

CVE-2022-24871HIGHCVSS 7.2EG 7.2
2022-04-20
Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current…
CVE-2022-1037HIGHCVSS 7.2EG 7.2
2022-04-18
The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs
CVE-2021-33581HIGHCVSS 7.2EG 7.2
2022-03-30
MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.we…
CVE-2021-4075HIGHCVSS 7.2EG 7.2
2021-12-06
snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2021-32639HIGHCVSS 7.2EG 7.2
2021-07-02
Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to…
CVE-2020-7329HIGHCVSS 7.2EG 7.2
2020-11-11
Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO adm…
CVE-2020-7328HIGHCVSS 7.2EG 7.2
2020-11-11
External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request,…
CVE-2020-24063HIGHCVSS 7.2EG 7.2
2020-11-10
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
CVE-2020-14044HIGHCVSS 7.2EG 7.2
2020-08-24
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via com…
CVE-2020-12725HIGHCVSS 7.2EG 7.2
2020-06-11
Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility i…
CVE-2020-11885HIGHCVSS 7.2EG 7.2
2020-04-17
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
CVE-2018-20499HIGHCVSS 7.2EG 7.2
2019-12-30
An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
CVE-2019-19999HIGHCVSS 7.2EG 7.2
2019-12-26
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVE-2019-8156HIGHCVSS 7.2EG 7.2
2019-11-06
A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api e…
CVE-2019-8151HIGHCVSS 7.2EG 7.2
2019-11-06
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-sid…
CVE-2019-7923HIGHCVSS 7.2EG 7.2
2019-08-02
A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment sett…
CVE-2019-7913HIGHCVSS 7.2EG 7.2
2019-08-02
A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment m…
CVE-2019-7911HIGHCVSS 7.2EG 7.2
2019-08-02
A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exp…
CVE-2019-7892HIGHCVSS 7.2EG 7.2
2019-08-02
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code…
CVE-2018-13790HIGHCVSS 7.2EG 7.2
2018-07-09
A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.
CVE-2017-18096HIGHCVSS 7.2EG 7.2
2018-04-04
The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources …
CVE-2017-14585HIGHCVSS 7.2EG 7.2
2017-11-27
A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hip…
CVE-2015-7570HIGHCVSS 7.2EG 7.2
2017-04-24
Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php, libs/or…
CVE-2026-45609HIGHCVSS 6.5EG 7.2
2026-05-18
mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) sec…
CVE-2026-40242HIGHCVSS 6.5EG 7.2
2026-04-10
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL withou…
CVE-2025-6851HIGHCVSS 6.5EG 7.2
2025-07-11
The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes i…
CVE-2025-50125HIGHCVSS 6.3EG 7.2
2025-07-11
A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header.
CVE-2026-0745HIGHCVSS 5.5EG 7.2
2026-02-14
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authent…
CVE-2026-63111HIGHCVSS 7.1EG 7.1
2026-11-05
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create Schedulers…
CVE-2026-118422HIGHCVSS 7.1EG 7.1
2026-11-04
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host a…
CVE-2026-63184HIGHCVSS 7.1EG 7.1
2026-10-30
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from…
CVE-2026-119549HIGHCVSS 7.1EG 7.1
2026-10-30
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via …
CVE-2026-65120HIGHCVSS 7.1EG 7.1
2026-10-27
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
CVE-2026-24269HIGHCVSS 7.1EG 7.1
2026-10-27
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
CVE-2026-101300HIGHCVSS 7.1EG 7.1
2026-10-16
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generate…
CVE-2026-76001HIGHCVSS 7.1EG 7.1
2026-10-13
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depen…
CVE-2026-110220HIGHCVSS 7.1EG 7.1
2026-10-13
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an…
CVE-2026-107362HIGHCVSS 7.1EG 7.1
2026-10-08
The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to …
CVE-2026-55096HIGHCVSS 7.1EG 7.1
2026-09-28
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads…
CVE-2026-101059HIGHCVSS 7.1EG 7.1
2026-09-27
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec…
CVE-2026-100849HIGHCVSS 7.1EG 7.1
2026-09-27
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discor…
CVE-2026-100848HIGHCVSS 7.1EG 7.1
2026-09-27
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or…
CVE-2026-100555HIGHCVSS 7.1EG 7.1
2026-09-26
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the ori…
CVE-2026-84395HIGHCVSS 7.1EG 7.1
2026-09-22
Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scop…
CVE-2026-85740HIGHCVSS 7.1EG 7.1
2026-09-22
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying a…
CVE-2026-92804HIGHCVSS 7.1EG 7.1
2026-09-16
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at…
CVE-2026-92602HIGHCVSS 7.1EG 7.1
2026-09-16
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary externa…
CVE-2026-18424HIGHCVSS 7.1EG 7.1
2026-09-15
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained…
CVE-2026-58485HIGHCVSS 7.1EG 7.1
2026-09-15
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the li…
CVE-2026-91938HIGHCVSS 7.1EG 7.1
2026-09-15
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, intern…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →