CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,205 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 73 of 85

CVE-2025-14793MEDIUMCVSS 5.0EG 5.0
2026-01-16
The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' function. This makes it possible for authenticated attackers, a…
CVE-2025-11128MEDIUMCVSS 5.0EG 5.0
2025-10-23
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds…
CVE-2025-62763MEDIUMCVSS 5.0EG 5.0
2025-10-21
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
CVE-2025-11536MEDIUMCVSS 5.0EG 5.0
2025-10-20
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenti…
CVE-2025-9799MEDIUMCVSS 5.0EG 5.0
2025-09-01
A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Pe…
CVE-2025-4655MEDIUMCVSS 5.0EG 5.0
2025-08-09
SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2…
CVE-2025-8341MEDIUMCVSS 5.0EG 5.0
2025-08-04
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to al…
CVE-2023-35817MEDIUMCVSS 5.0EG 5.0
2025-04-28
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
CVE-2025-32102MEDIUMCVSS 5.0EG 5.0
2025-04-15
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.
CVE-2024-52602MEDIUMCVSS 5.0EG 5.0
2025-01-16
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain condit…
CVE-2024-46990MEDIUMCVSS 5.0EG 5.0
2024-09-18
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like …
CVE-2024-41737MEDIUMCVSS 5.0EG 5.0
2024-08-13
SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no im…
CVE-2024-37171MEDIUMCVSS 5.0EG 5.0
2024-07-09
SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unint…
CVE-2024-34689MEDIUMCVSS 5.0EG 5.0
2024-07-09
WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclo…
CVE-2024-39598MEDIUMCVSS 5.0EG 5.0
2024-07-09
SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It …
CVE-2024-39699MEDIUMCVSS 5.0EG 5.0
2024-07-08
Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP ad…
CVE-2024-0862MEDIUMCVSS 5.0EG 5.0
2024-05-14
The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user to relay HTTP requests from the Protection server to otherwise private network ad…
CVE-2024-23336MEDIUMCVSS 5.0EG 5.0
2024-05-01
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallow…
CVE-2024-33590MEDIUMCVSS 5.0EG 5.0
2024-04-29
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
CVE-2024-3448MEDIUMCVSS 5.0EG 5.0
2024-04-10
Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returne…
CVE-2023-5122MEDIUMCVSS 5.0EG 5.0
2024-02-14
Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an admin…
CVE-2023-6388MEDIUMCVSS 5.0EG 5.0
2024-02-07
Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF.
CVE-2023-26435MEDIUMCVSS 5.0EG 5.0
2023-06-20
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read pe…
CVE-2023-26431MEDIUMCVSS 5.0EG 5.0
2023-06-20
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted …
CVE-2023-26492MEDIUMCVSS 5.0EG 5.0
2023-03-03
Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass …
CVE-2023-23943MEDIUMCVSS 5.0EG 5.0
2023-02-06
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Ser…
CVE-2023-24060MEDIUMCVSS 5.0EG 5.0
2023-01-27
Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Hav…
CVE-2022-41949MEDIUMCVSS 5.0EG 5.0
2022-12-08
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to ext…
CVE-2022-23080MEDIUMCVSS 5.0EG 5.0
2022-06-22
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
CVE-2021-34811MEDIUMCVSS 5.0EG 5.0
2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.
CVE-2021-22178MEDIUMCVSS 5.0EG 5.0
2021-03-24
An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.
CVE-2020-36232MEDIUMCVSS 5.0EG 5.0
2021-02-22
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DN…
CVE-2020-15002MEDIUMCVSS 5.0EG 5.0
2020-10-23
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.
CVE-2020-12644MEDIUMCVSS 5.0EG 5.0
2020-08-31
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.
CVE-2020-9427MEDIUMCVSS 5.0EG 5.0
2020-06-15
OX Guard 2.10.3 and earlier allows SSRF.
CVE-2019-18846MEDIUMCVSS 5.0EG 5.0
2020-02-21
OX App Suite through 7.10.2 allows SSRF.
CVE-2020-8118MEDIUMCVSS 5.0EG 5.0
2020-02-04
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.
CVE-2018-20497MEDIUMCVSS 5.0EG 5.0
2019-12-30
An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
CVE-2019-1679MEDIUMCVSS 5.0EG 5.0
2019-02-07
A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from a…
CVE-2026-33294MEDIUMCVSS 4.3EG 5.0
2026-03-22
WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all …
CVE-2023-6124MEDIUMCVSS 4.3EG 5.0
2023-11-14
Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14.
CVE-2026-63441MEDIUMCVSS 4.9EG 4.9
2026-11-06
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 …
CVE-2026-102337MEDIUMCVSS 4.9EG 4.9
2026-11-04
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public…
CVE-2026-76083MEDIUMCVSS 4.9EG 4.9
2026-10-14
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL…
CVE-2026-108115MEDIUMCVSS 4.9EG 4.9
2026-10-10
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers …
CVE-2026-14521MEDIUMCVSS 4.9EG 4.9
2026-10-08
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unaut…
CVE-2026-80464MEDIUMCVSS 4.9EG 4.9
2026-10-02
Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned t…
CVE-2026-92813MEDIUMCVSS 4.9EG 4.9
2026-09-16
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigge…
CVE-2026-78277MEDIUMCVSS 4.9EG 4.9
2026-08-24
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-73307MEDIUMCVSS 4.9EG 4.9
2026-08-12
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/works…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →