Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

Implementation, Operation

If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Implementation, Operation

If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Implementation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

178 results · Clear filters · Feed

Medium 6.9

CVE-2025-34282 Public exploit

ThingsBoard < v4.2.1 SVG Image SSRF

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way th…

ThingsBoard ThingsBoard

Oct 17, 2025
High 7.5

CVE-2025-61884 Exploited · Ransomware Public exploit Scanner template EPSS 96%

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions…

Oracle Oracle Configurator

Oct 12, 2025
KEV Oct 20, 2025
Medium 4.7

CVE-2025-55971 Public exploit

TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to…

Oct 3, 2025
Medium 6.5

CVE-2025-57055 Public exploit

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An…

Sep 17, 2025
High 7.2

CVE-2025-58179 Public exploit Scanner template

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…

withastro astro @astrojs/cloudflare npm

Sep 4, 2025
Critical 9.9

CVE-2025-54381 Public exploit EPSS 14%

BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force t…

bentoml BentoML bentoml PyPI

Jul 29, 2025
Low 3.7

CVE-2025-51591 Public exploit

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole i…

pandoc pandoc Debian Ubuntu

Jul 11, 2025
High 7.5

CVE-2025-27817 Public exploit Scanner template EPSS 70%

Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and …

Apache Software Foundation Apache Kafka Client druid thingsboard-tb-node Wolfi Maven

Jun 10, 2025
Critical 9.9

CVE-2025-29972 Public exploit

Azure Storage Resource Provider Spoofing Vulnerability

Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.

Microsoft Azure Storage Resource Provider (SRP)

May 8, 2025
Medium 5.5

CVE-2025-45250 Public exploit

MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/…

May 6, 2025
Critical 9.3

CVE-2025-32013 Public exploit

Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback …

lnbits lnbits lnbits PyPI

Apr 6, 2025
Medium 6.5

CVE-2025-0184 Public exploit

Server-Side Request Forgery (SSRF) in langgenius/dify

A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value i…

langgenius langgenius/dify

Mar 20, 2025
Critical 9.8

CVE-2024-48590 Public exploit

Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows a…

Mar 20, 2025
High 7.7

CVE-2025-27152 Public exploit

Possible SSRF and Credential Leakage via Absolute URL in axios Requests

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm

Mar 7, 2025
Medium 5.3

CVE-2025-24354 Public exploit Scanner template

imgproxy is vulnerable to SSRF against 0.0.0.0

imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.

imgproxy imgproxy github.com/imgproxy/imgproxy/v3 github.com/imgproxy/imgproxy Go

Jan 27, 2025
High 8.8

CVE-2025-21385 Public exploit EPSS 28%

Microsoft Purview Information Disclosure Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

Microsoft Microsoft Purview

Jan 9, 2025
Critical 9.1

CVE-2024-54819 Public exploit EPSS 21%

I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input vali…

Jan 7, 2025
High 7.4

CVE-2024-56800 Public exploit

Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious sit…

mendableai firecrawl

Dec 30, 2024
Medium 5.4

CVE-2024-51463 Public exploit

IBM i server-side request forgery

IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM i

Dec 21, 2024
High 7.2

CVE-2024-54385 Public exploit Scanner template

WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.

princeahmed Radio Player

Dec 16, 2024
High 7.2

CVE-2024-54330 Public exploit Scanner template

WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.

hurraki Hurrakify

Dec 13, 2024
Critical 9.8

CVE-2024-55875 Public exploit

http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read loc…

http4k http4k org.http4k:http4k-format-xml Maven

Dec 12, 2024
Critical 9.8

CVE-2024-51358 Public exploit

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to th…

Nov 5, 2024
Medium 4.9

CVE-2024-51665 Public exploit

WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through <= 1.2.1.

Noor Alam Magical Addons For Elementor

Nov 4, 2024
High 7.5

CVE-2024-48360 Public exploit Scanner template

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.…

Oct 31, 2024
Medium 6.9

CVE-2024-47167 Public exploit

SSRF in the path parameter of /queue/join in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/join` endpoint. Gradio’s `async_save_url_to_cache` function allows attackers to force the Gradio server…

gradio-app gradio gradio PyPI

Oct 10, 2024
Critical 9.0

CVE-2024-47066 Public exploit EPSS 12%

Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an externa…

lobehub lobe-chat @lobehub/chat npm

Sep 23, 2024
High 8.8

CVE-2024-45507 Public exploit Scanner template EPSS 96%

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Apache Software Foundation Apache OFBiz

Sep 4, 2024
Critical 9.8

CVE-2024-41570 Public exploit

An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to sen…

Aug 9, 2024
High 8.6

CVE-2024-39713 Public exploit Scanner template

Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

RocketChat Rocket.Chat rocket.chat npm

Aug 5, 2024
Critical 9.1

CVE-2024-40898 Public exploit

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Apache Software Foundation Apache HTTP Server apache2 Alpine

Jul 18, 2024
Medium 5.8

CVE-2024-6095 Public exploit Scanner template

SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. …

mudler mudler/localai

Jul 6, 2024
High 8.6

CVE-2024-34361 Public exploit

Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlockl…

pi-hole pi-hole

Jul 5, 2024
High 7.5

CVE-2024-38472 Public exploit Scanner template EPSS 69%

Apache HTTP Server on WIndows UNC SSRF

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access…

Apache Software Foundation Apache HTTP Server apache2 Alpine

Jul 1, 2024
High 8.2

CVE-2024-5736 Public exploit

SSRF in AdmirorFrames Joomla! Extension

Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.

Nikola Vasilijevski AdmirorFrames

Jun 28, 2024
High 7.2

CVE-2024-20404 Public exploit Scanner template EPSS 23%

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker …

Cisco Cisco Unified Contact Center Express Cisco Unified Contact Center Enterprise Cisco Packaged Contact Center Enterprise Network devices

Jun 5, 2024
High 8.1

CVE-2024-29415 Public exploit

ip SSRF improper categorization in isPublic

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

jupyter-base-notebook sqlpad pnpm-stage0 py3.10-jupyterlab Debian Ubuntu Wolfi npm

May 27, 2024
High 7.5

CVE-2024-34351 Public exploit Scanner template

Next.js Server-Side Request Forgery in Server Actions

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

vercel next.js jitsucom-jitsu-console next Wolfi npm

May 9, 2024
High 8.1

CVE-2024-22262 Public exploit

CVE-2024-22262: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html a…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Apr 16, 2024
High 7.5

CVE-2024-27620 Public exploit

An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request…

Apr 6, 2024