CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4719 vulnerabilities reference this CWE, most recent first.
GHSA-3GM6-8RM6-Q59F
Vulnerability from github – Published: 2026-07-19 09:31 – Updated: 2026-07-19 09:31A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
{
"affected": [],
"aliases": [
"CVE-2026-16223"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T08:16:43Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-3gm6-8rm6-q59f",
"modified": "2026-07-19T09:31:36Z",
"published": "2026-07-19T09:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16223"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM/issues/2687"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM/issues/2688"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16223"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/858045"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/858046"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380045"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380045/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3GQR-3P72-MQM3
Vulnerability from github – Published: 2025-02-19 03:32 – Updated: 2025-02-19 03:32A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2025-1447"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-19T01:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.",
"id": "GHSA-3gqr-3p72-mqm3",
"modified": "2025-02-19T03:32:05Z",
"published": "2025-02-19T03:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1447"
},
{
"type": "WEB",
"url": "https://github.com/sheratan4/cve/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/kasuganosoras/Pigeon/commit/84cea5fe73141689da2e7ec8676d47435bd6423e"
},
{
"type": "WEB",
"url": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.181"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.296134"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.296134"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.501978"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3GWQ-RJ9C-4F42
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 03:31SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-42965"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T01:15:23Z",
"severity": "MODERATE"
},
"details": "SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.",
"id": "GHSA-3gwq-rj9c-4f42",
"modified": "2025-07-08T03:31:00Z",
"published": "2025-07-08T03:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42965"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3598118"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H26-Q9XC-FJFF
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:53ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
{
"affected": [],
"aliases": [
"CVE-2019-9187"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-05T18:29:00Z",
"severity": "HIGH"
},
"details": "ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.",
"id": "GHSA-3h26-q9xc-fjff",
"modified": "2024-04-04T00:53:12Z",
"published": "2022-05-24T16:47:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9187"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news/version_3.20190228"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HH3-HX7R-GGC2
Vulnerability from github – Published: 2026-04-09 15:35 – Updated: 2026-04-14 18:30Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
{
"affected": [],
"aliases": [
"CVE-2025-50228"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-09T15:16:07Z",
"severity": "CRITICAL"
},
"details": "Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.",
"id": "GHSA-3hh3-hx7r-ggc2",
"modified": "2026-04-14T18:30:31Z",
"published": "2026-04-09T15:35:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50228"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms/issues/104"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms"
},
{
"type": "WEB",
"url": "https://www.jizhicms.cn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HR5-6MX7-874C
Vulnerability from github – Published: 2025-04-27 00:30 – Updated: 2025-04-28 12:30A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3954"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-26T22:15:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3hr5-6mx7-874c",
"modified": "2025-04-28T12:30:24Z",
"published": "2025-04-27T00:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3954"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/p/2c56b9ec-5747-40a3-b089-ff796f23ebd4"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/ssrf-via-referrer-field-in-churchcrm-v5-16-0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555938"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3HVP-8GH4-HRX5
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
{
"affected": [],
"aliases": [
"CVE-2020-25353"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-20T19:15:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.",
"id": "GHSA-3hvp-8gh4-hrx5",
"modified": "2022-05-24T19:11:48Z",
"published": "2022-05-24T19:11:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25353"
},
{
"type": "WEB",
"url": "https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3J6C-RQ24-CP7J
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-13 21:30Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <= 1.4.0.
{
"affected": [],
"aliases": [
"CVE-2026-39695"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:41Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through \u003c= 1.4.0.",
"id": "GHSA-3j6c-rq24-cp7j",
"modified": "2026-04-13T21:30:36Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39695"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/podigee/vulnerability/wordpress-podigee-plugin-1-4-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3J96-4R54-MHQG
Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2022-09-23 00:00The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
{
"affected": [],
"aliases": [
"CVE-2022-30579"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-20T19:15:00Z",
"severity": "HIGH"
},
"details": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.",
"id": "GHSA-3j96-4r54-mhqg",
"modified": "2022-09-23T00:00:42Z",
"published": "2022-09-21T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30579"
},
{
"type": "WEB",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"type": "WEB",
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3J9J-5462-CPX8
Vulnerability from github – Published: 2023-10-22 18:30 – Updated: 2025-11-04 18:30link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
{
"affected": [],
"aliases": [
"CVE-2023-46303"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-22T18:15:08Z",
"severity": "HIGH"
},
"details": "link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.",
"id": "GHSA-3j9j-5462-cpx8",
"modified": "2025-11-04T18:30:44Z",
"published": "2023-10-22T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46303"
},
{
"type": "WEB",
"url": "https://github.com/0x1717/ssrf-via-img"
},
{
"type": "WEB",
"url": "https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.