Skip to content
OpenAdvisories

Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

  1. Implementation, Operation

    If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  2. Implementation, Operation

    If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  3. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

1,873 results · Clear filters · Feed

  • Medium 4.1
    CVE-2025-27907

    IBM WebSphere Application Server server-side request forgery

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    IBM WebSphere Application Server
  • Medium 6.5
    CVE-2025-29455

    An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive i…

  • Medium 6.5
    CVE-2025-29450

    An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings com…

  • Medium 6.5
    CVE-2025-29453

    An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive i…

  • Medium 6.5
    CVE-2025-29456

    An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive i…

  • Medium 6.5
    CVE-2025-29454

    An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive i…

  • Medium 6.5
    CVE-2025-29449

    An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identificati…

  • Medium 6.5
    CVE-2024-56736

    Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

    Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

    Apache Software Foundation Apache HertzBeat
  • Medium 5.4
    CVE-2025-30964

    WordPress Photography theme < 7.7.6 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from n/a through < 7.7.6.

    ThemeGoods Photography
  • Medium 4.4
    CVE-2025-26990

    WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1006.

    WP Royal Royal Elementor Addons
  • Medium 5.0
    CVE-2025-32102

    CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=…

    CrushFTP CrushFTP
  • Medium 4.8
    CVE-2025-29720

    Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_f…

  • Medium 6.0
    CVE-2025-22374

    SSRF in CyberAudit-Web videx-legacy-ssl

    A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatch…

    Videx CyberAudit-Web
  • Medium 5.9
    CVE-2025-0539

    In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests t…

    Octopus Deploy Octopus Server
  • Medium 5.4
    CVE-2025-31009

    WordPress IndieBlocks plugin <= 0.13.1 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through <= 0.13.1.

    Jan Boddez IndieBlocks
  • Medium 4.9
    CVE-2025-32487

    WordPress Waymark plugin <= 1.5.2 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5.2.

    Joe Waymark
  • Medium 6.8
    CVE-2025-32675

    WordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a through <= 6.7.9.

    Quantum Cloud SEO Help
  • Medium 4.9
    CVE-2025-32691

    WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.12.6.

    blubrry PowerPress Podcasting
  • Medium 6.5
    CVE-2025-32372

    Server-Side Request Forgery (SSRF) in DotNetNuke.Core

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET reques…

    dnnsoftware Dnn.Platform DotNetNuke.Core NuGet
  • Medium 6.3
    CVE-2025-3412

    mymagicpower AIAS InferController.java server-side request forgery

    A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the…

    mymagicpower AIAS
  • Medium 6.3
    CVE-2025-3411

    mymagicpower AIAS AsrController.java server-side request forgery

    A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation…

    mymagicpower AIAS
  • Medium 4.0
    CVE-2025-32358

    In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are trigge…

    zammad zammad
  • Medium 6.3
    CVE-2025-3254

    xujiangfei admintwo add server-side request forgery

    A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch th…

    xujiangfei admintwo
  • Medium 6.9
    CVE-2025-2245

    Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)

    A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize ho…

    Bitdefender GravityZone Update Server
  • Medium 6.9
    CVE-2025-2243

    SSRF in GravityZone Console via DNS Truncation (VA-12634)

    A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for exec…

    Bitdefender GravityZone Console
  • Medium 5.4
    CVE-2025-31824

    WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.

    Wombat Plugins WP Optin Wheel
  • Medium 5.4
    CVE-2025-31796

    WordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue affects ElementsCSS Addons for Elementor: from n/a through <= 1.0.8.9.

    TheInnovs ElementsCSS Addons for Elementor
  • Medium 6.9
    CVE-2025-31117

    OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

    OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthoriz…

    Open-Emr openemr
  • Medium 4.4
    CVE-2025-31116

    Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

    Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSR…

    MobSF Mobile-Security-Framework-MobSF mobsf PyPI
  • Medium 6.3
    CVE-2025-2997

    zhangyanbo2007 youkefu url server-side request forgery

    A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack…

    zhangyanbo2007 youkefu
  • Medium 6.4
    CVE-2025-31527

    WordPress WP Link Preview plugin <= 1.4.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Preview: from n/a through <= 1.4.1.

    Kishan WP Link Preview
  • Medium 4.9
    CVE-2025-31076

    WordPress WP Compress for MainWP plugin <= 6.30.03 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects WP Compress for MainWP: from n/a through <= 6.30.03.

    WP Compress WP Compress for MainWP
  • Medium 6.3
    CVE-2025-28093

    ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings

    ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.

    shopxo/shopxo Packagist
  • Medium 5.4
    CVE-2025-28096

    OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.

  • Medium 6.3
    CVE-2025-28092

    ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload

    ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.

    shopxo/shopxo Packagist
  • Medium 6.5
    CVE-2025-28094

    ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)

    shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.

    shopxo/shopxo Packagist
  • Medium 6.5
    CVE-2024-48944

    Apache Kylin: SSRF vulnerability in the diagnosis api

    Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The att…

    Apache Software Foundation Apache Kylin org.apache.kylin:kylin-common-server Maven
  • Medium 4.9
    CVE-2025-22672

    WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.2.

    SuitePlugins Video & Photo Gallery for Ultimate Member
  • Medium 4.4
    CVE-2025-30914

    WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through <= 3.9.2.

    roxnor Metform
  • Medium 4.3
    CVE-2025-2835

    zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

    A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request …

    zhangyd-c OneBlog