CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 54 of 85

CVE-2025-28987MEDIUMCVSS 6.4EG 6.4
2025-08-14
Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward: from n/a through <= 5.9.5.
CVE-2025-6729MEDIUMCVSS 6.4EG 6.4
2025-07-04
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with…
CVE-2025-52713MEDIUMCVSS 6.4EG 6.4
2025-06-20
Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVE-2025-47484MEDIUMCVSS 6.4EG 6.4
2025-05-07
Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through <= 1.1.0.
CVE-2025-46511MEDIUMCVSS 6.4EG 6.4
2025-04-24
Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects BeerXML Shortcode: from n/a through <= 0.7.1.
CVE-2025-31527MEDIUMCVSS 6.4EG 6.4
2025-03-31
Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Preview: from n/a through <= 1.4.1.
CVE-2024-13411MEDIUMCVSS 6.4EG 6.4
2025-03-26
The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-lev…
CVE-2024-13856MEDIUMCVSS 6.4EG 6.4
2025-03-22
The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it poss…
CVE-2025-1662MEDIUMCVSS 6.4EG 6.4
2025-02-28
The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action. This makes it possible for authenticated attackers, with a…
CVE-2024-13695MEDIUMCVSS 6.4EG 6.4
2025-02-25
The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and…
CVE-2025-1043MEDIUMCVSS 6.4EG 6.4
2025-02-20
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for a…
CVE-2025-22346MEDIUMCVSS 6.4EG 6.4
2025-01-15
Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.
CVE-2024-6155MEDIUMCVSS 6.4EG 6.4
2025-01-09
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing…
CVE-2024-56279MEDIUMCVSS 6.4EG 6.4
2025-01-07
Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through <= 1.9.14.
CVE-2024-52579MEDIUMCVSS 6.4EG 6.4
2024-12-18
Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may re…
CVE-2024-10814MEDIUMCVSS 6.4EG 6.4
2024-11-09
The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the ce_get_file() function. This makes it possible for authenticated attackers, with contributor-level access an…
CVE-2024-2090MEDIUMCVSS 6.4EG 6.4
2024-08-01
The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content shortcode. This makes it possible for authenticated attackers, with contributor…
CVE-2024-38723MEDIUMCVSS 6.4EG 6.4
2024-07-22
Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6.
CVE-2024-37157MEDIUMCVSS 6.4EG 6.4
2024-07-03
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an …
CVE-2024-4354MEDIUMCVSS 6.4EG 6.4
2024-06-07
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the get_files_to_import() function. This makes it possible for authenticated a…
CVE-2023-7073MEDIUMCVSS 6.4EG 6.4
2024-05-31
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated att…
CVE-2024-4789MEDIUMCVSS 6.4EG 6.4
2024-05-17
Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level acc…
CVE-2024-34068MEDIUMCVSS 6.4EG 6.4
2024-05-03
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal e…
CVE-2024-0216MEDIUMCVSS 6.4EG 6.4
2024-04-30
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above…
CVE-2024-32803MEDIUMCVSS 6.4EG 6.4
2024-04-24
Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.40.3.
CVE-2023-6805MEDIUMCVSS 6.4EG 6.4
2024-04-17
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed funct…
CVE-2024-30256MEDIUMCVSS 6.4EG 6.4
2024-04-16
Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.
CVE-2024-2343MEDIUMCVSS 6.4EG 6.4
2024-04-09
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the form_to_url_action function. This makes it possible for authentic…
CVE-2024-24888MEDIUMCVSS 6.4EG 6.4
2024-04-02
Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.2.25.
CVE-2024-1568MEDIUMCVSS 6.4EG 6.4
2024-02-28
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with sub…
CVE-2021-40109MEDIUMCVSS 6.4EG 6.4
2021-09-27
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any …
CVE-2021-31779MEDIUMCVSS 6.4EG 6.4
2021-04-28
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
CVE-2021-23927MEDIUMCVSS 6.4EG 6.4
2021-01-12
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.
CVE-2020-13286MEDIUMCVSS 6.4EG 6.4
2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.
CVE-2018-1000182MEDIUMCVSS 6.4EG 6.4
2018-06-05
A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall…
CVE-2026-33675MEDIUMCVSS 5.4EG 6.4
2026-03-24
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests with…
CVE-2023-4651MEDIUMCVSS 5.4EG 6.4
2023-08-31
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
CVE-2026-49951MEDIUMCVSS 6.3EG 6.3
2026-11-06
RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the PO…
CVE-2026-121927MEDIUMCVSS 6.3EG 6.3
2026-11-04
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argumen…
CVE-2026-118577MEDIUMCVSS 6.3EG 6.3
2026-10-28
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is…
CVE-2026-116056MEDIUMCVSS 6.3EG 6.3
2026-10-25
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is pos…
CVE-2026-114362MEDIUMCVSS 6.3EG 6.3
2026-10-21
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request for…
CVE-2026-112991MEDIUMCVSS 6.3EG 6.3
2026-10-19
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incompl…
CVE-2026-94621MEDIUMCVSS 6.3EG 6.3
2026-10-15
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a se…
CVE-2026-109402MEDIUMCVSS 6.3EG 6.3
2026-10-13
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulati…
CVE-2026-109190MEDIUMCVSS 6.3EG 6.3
2026-10-13
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to…
CVE-2026-109189MEDIUMCVSS 6.3EG 6.3
2026-10-13
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the compon…
CVE-2026-108787MEDIUMCVSS 6.3EG 6.3
2026-10-12
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url resu…
CVE-2026-108786MEDIUMCVSS 6.3EG 6.3
2026-10-12
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. Th…
CVE-2026-108542MEDIUMCVSS 6.3EG 6.3
2026-10-11
A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in serve…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →