Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4736 vulnerabilities reference this CWE, most recent first.

GHSA-27GC-2P8C-X84F

Vulnerability from github – Published: 2025-06-24 21:30 – Updated: 2025-06-27 18:30
VLAI
Details

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a Server-Side Request Forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-49852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-24T20:15:25Z",
    "severity": "HIGH"
  },
  "details": "ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a Server-Side Request Forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.",
  "id": "GHSA-27gc-2p8c-x84f",
  "modified": "2025-06-27T18:30:42Z",
  "published": "2025-06-24T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49852"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-27P5-7CW6-M45H

Vulnerability from github – Published: 2019-10-24 20:46 – Updated: 2024-11-18 22:12
VLAI
Summary
Server-Side Request Forgery in unoconv
Details

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "unoconv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-17400"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-10-24T20:46:04Z",
    "nvd_published_at": "2019-10-21T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.",
  "id": "GHSA-27p5-7cw6-m45h",
  "modified": "2024-11-18T22:12:44Z",
  "published": "2019-10-24T20:46:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17400"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unoconv/unoconv/pull/510"
    },
    {
      "type": "WEB",
      "url": "https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-27p5-7cw6-m45h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/unoconv/PYSEC-2019-213.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/unoconv/unoconv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Server-Side Request Forgery in unoconv"
}

GHSA-27WW-388C-HFHF

Vulnerability from github – Published: 2025-04-18 00:30 – Updated: 2025-04-23 15:30
VLAI
Details

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-17T22:15:15Z",
    "severity": "HIGH"
  },
  "details": "An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.",
  "id": "GHSA-27ww-388c-hfhf",
  "modified": "2025-04-23T15:30:47Z",
  "published": "2025-04-18T00:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29457"
    },
    {
      "type": "WEB",
      "url": "https://docs.mybb.com/1.8/administration/security/protection/#limit-access-to-private-hosts-and-ip-addresses"
    },
    {
      "type": "WEB",
      "url": "https://www.yuque.com/morysummer/vx41bz/vro4dvxzuiwlg6uv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2823-WFGM-J3HR

Vulnerability from github – Published: 2025-04-21 18:32 – Updated: 2025-05-12 15:30
VLAI
Details

open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-21T17:15:23Z",
    "severity": "LOW"
  },
  "details": "open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection.",
  "id": "GHSA-2823-wfgm-j3hr",
  "modified": "2025-05-12T15:30:40Z",
  "published": "2025-04-21T18:32:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-284F-F2HW-J2GX

Vulnerability from github – Published: 2021-10-12 18:41 – Updated: 2021-10-18 18:15
VLAI
Summary
Server-Side Request Forgery vulnerability in concrete5
Details

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "concrete5/concrete5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-22958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-08T21:44:32Z",
    "nvd_published_at": "2021-10-07T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery vulnerability was found in concrete5 \u003c 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.",
  "id": "GHSA-284f-f2hw-j2gx",
  "modified": "2021-10-18T18:15:50Z",
  "published": "2021-10-12T18:41:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concrete5/concrete5/pull/8826"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/863221"
    },
    {
      "type": "WEB",
      "url": "https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/concrete5/concrete5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server-Side Request Forgery vulnerability in concrete5"
}

GHSA-2858-XG23-26FP

Vulnerability from github – Published: 2026-03-03 21:18 – Updated: 2026-03-03 21:18
VLAI
Summary
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
Details

Summary

OpenClaw accepted camera.snap / camera.clip node payload url fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host.

In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: >= 2026.2.13 <= 2026.3.1
  • Latest vulnerable published version at time of update: 2026.3.1
  • Patched versions: >= 2026.3.2 (released)

Technical Details

Vulnerable flows accepted URL payloads and downloaded directly from the provided URL: - src/cli/nodes-camera.ts (writeUrlToFile) fetched URL payloads without node-host binding. - src/cli/nodes-cli/register.camera.ts passed camera.snap / camera.clip payload URLs into that downloader. - src/agents/tools/nodes-tool.ts did the same for camera_snap / camera_clip tool actions.

Impact

A malicious/compromised paired node could cause gateway-host URL fetches to off-node destinations reachable from the host network. This could be used for internal network probing/fetch pivots in deployments where paired nodes are not fully trusted.

Remediation

The fix introduces fail-closed node-host binding and guarded fetch for camera URL payload downloads: - Require resolved node host metadata for URL payload downloads. - Enforce hostname match between payload URL and resolved node host. - Use SSRF-guarded fetch with redirect host/protocol checks. - Apply the same enforcement across CLI and agent tool camera paths.

Fix Commit(s)

  • 3bf19d6f40a0aaa55818b96eede3d05130c02533
Severity
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.2.13"
            },
            {
              "fixed": "2026.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:18:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nOpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host.\n\nIn OpenClaw\u0027s documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003e= 2026.2.13 \u003c= 2026.3.1`\n- Latest vulnerable published version at time of update: `2026.3.1`\n- Patched versions: `\u003e= 2026.3.2` (released)\n\n### Technical Details\nVulnerable flows accepted URL payloads and downloaded directly from the provided URL:\n- `src/cli/nodes-camera.ts` (`writeUrlToFile`) fetched URL payloads without node-host binding.\n- `src/cli/nodes-cli/register.camera.ts` passed `camera.snap` / `camera.clip` payload URLs into that downloader.\n- `src/agents/tools/nodes-tool.ts` did the same for `camera_snap` / `camera_clip` tool actions.\n\n### Impact\nA malicious/compromised paired node could cause gateway-host URL fetches to off-node destinations reachable from the host network. This could be used for internal network probing/fetch pivots in deployments where paired nodes are not fully trusted.\n\n### Remediation\nThe fix introduces fail-closed node-host binding and guarded fetch for camera URL payload downloads:\n- Require resolved node host metadata for URL payload downloads.\n- Enforce hostname match between payload URL and resolved node host.\n- Use SSRF-guarded fetch with redirect host/protocol checks.\n- Apply the same enforcement across CLI and agent tool camera paths.\n\n### Fix Commit(s)\n- `3bf19d6f40a0aaa55818b96eede3d05130c02533`",
  "id": "GHSA-2858-xg23-26fp",
  "modified": "2026-03-03T21:18:56Z",
  "published": "2026-03-03T21:18:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2858-xg23-26fp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/3bf19d6f40a0aaa55818b96eede3d05130c02533"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots"
}

GHSA-286Q-C3P5-X28W

Vulnerability from github – Published: 2024-01-18 00:30 – Updated: 2024-01-18 00:30
VLAI
Details

A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-0649"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-17T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375.",
  "id": "GHSA-286q-c3p5-x28w",
  "modified": "2024-01-18T00:30:17Z",
  "published": "2024-01-18T00:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0649"
    },
    {
      "type": "WEB",
      "url": "https://note.zhaoj.in/share/jC6NMe5TRSys"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.251375"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.251375"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-287C-FXR7-3W6C

Vulnerability from github – Published: 2026-05-01 12:30 – Updated: 2026-05-07 02:54
VLAI
Summary
Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
Details

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.neethi:neethi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T02:54:54Z",
    "nvd_published_at": "2026-05-01T11:16:19Z",
    "severity": "MODERATE"
  },
  "details": "Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes this issue.",
  "id": "GHSA-287c-fxr7-3w6c",
  "modified": "2026-05-07T02:54:54Z",
  "published": "2026-05-01T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42404"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/ws-neethi"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/01/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Neethi doesn\u0027t impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API"
}

GHSA-289V-J7VM-CM7Q

Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45
VLAI
Details

A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-24T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.",
  "id": "GHSA-289v-j7vm-cm7q",
  "modified": "2022-05-24T17:45:17Z",
  "published": "2022-05-24T17:45:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22179"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1055816"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22179.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/293733"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-28CV-7XWR-65C6

Vulnerability from github – Published: 2025-10-02 18:31 – Updated: 2025-10-02 21:31
VLAI
Details

VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-57305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-02T16:15:35Z",
    "severity": "MODERATE"
  },
  "details": "VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.",
  "id": "GHSA-28cv-7xwr-65c6",
  "modified": "2025-10-02T21:31:18Z",
  "published": "2025-10-02T18:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57305"
    },
    {
      "type": "WEB",
      "url": "https://www.mattz.io/posts/cve-2025-57305"
    },
    {
      "type": "WEB",
      "url": "http://vitaracharts.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list