CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4712 vulnerabilities reference this CWE, most recent first.
GHSA-67QP-QFF2-GGPP
Vulnerability from github – Published: 2024-12-27 18:30 – Updated: 2024-12-27 18:30A vulnerability was found in WISI Tangram GT31 up to 20241214 and classified as problematic. Affected by this issue is some unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-12989"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T18:15:24Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in WISI Tangram GT31 up to 20241214 and classified as problematic. Affected by this issue is some unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-67qp-qff2-ggpp",
"modified": "2024-12-27T18:30:26Z",
"published": "2024-12-27T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12989"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.289382"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.289382"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.463798"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-682X-F2HF-9MPF
Vulnerability from github – Published: 2026-03-12 00:31 – Updated: 2026-03-12 00:31A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file /src/main/java/com/genersoft/iot/vmp/media/abl/ABLMediaNodeServerService.java of the component IP Address Handler. The manipulation of the argument MediaServer.streamIp results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-3966"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-12T00:16:12Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file /src/main/java/com/genersoft/iot/vmp/media/abl/ABLMediaNodeServerService.java of the component IP Address Handler. The manipulation of the argument MediaServer.streamIp results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-682x-f2hf-9mpf",
"modified": "2026-03-12T00:31:17Z",
"published": "2026-03-12T00:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3966"
},
{
"type": "WEB",
"url": "https://github.com/AnalogyC0de/public_exp/issues/15"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.350395"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.350395"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768915"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-683J-3V25-H2QG
Vulnerability from github – Published: 2025-06-19 00:31 – Updated: 2025-06-19 00:31The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
{
"affected": [],
"aliases": [
"CVE-2025-23172"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T00:15:21Z",
"severity": "HIGH"
},
"details": "The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the \"Add Webhook\" and \"Test Webhook\" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. \n \nExploitation Status: \n\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \n\nWorkarounds or Mitigation: \n\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.",
"id": "GHSA-683j-3v25-h2qg",
"modified": "2025-06-19T00:31:06Z",
"published": "2025-06-19T00:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23172"
},
{
"type": "WEB",
"url": "https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b"
},
{
"type": "WEB",
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
},
{
"type": "WEB",
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"type": "WEB",
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"type": "WEB",
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-686C-7VGV-V3FX
Vulnerability from github – Published: 2026-05-19 19:53 – Updated: 2026-05-19 19:53Summary
Unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred.
Details
The POST /api/v2/workspaceagents/azure-instance-identity endpoint accepts a PKCS#7 signature without authentication. During certificate chain verification, azureidentity.Validate() iterates over the signer certificate's IssuingCertificateURL extension and fetches each URL using http.DefaultClient with no host restriction, no private-IP blocking, and no response-size limit.
An attacker crafts a self-signed certificate whose Common Name matches *.metadata.azure.com (passing the allowedSigners regex) and whose IssuingCertificateURL points to an attacker-chosen target. The server fetches that URL and feeds the response body into x509.ParseCertificate. The parsed result is discarded, but the wrapped error string is returned verbatim in the JSON response via Detail: err.Error(). Connection-level errors ("connection refused", "i/o timeout", DNS failures) and certificate-parse errors give the attacker enough signal to infer host reachability and port state without seeing the actual response content.
Root causes:
- No allowlist on
IssuingCertificateURLhosts. Any URL was accepted. http.DefaultClientwas used. It follows redirects and connects to private, link-local, and loopback addresses.- Unbounded
io.ReadAllon the response body (memory exhaustion vector). - Raw
err.Error()was returned in the JSON response, leaking internal HTTP client errors to the caller.
Impact
This is a semi-blind SSRF: the server makes the outbound request but the HTTP response body is consumed by x509.ParseCertificate and never returned to the attacker.
- Internal network reconnaissance. The attacker can map internal hosts and ports by observing error differentiation in the API response: "connection refused" (port closed), "i/o timeout" (host unreachable or firewalled), DNS failure (host does not exist), or certificate-parse error (port open and responding). This enables systematic scanning of the internal network from the Coder server's vantage point.
- Requests to sensitive endpoints. The server can be directed to hit cloud metadata services (e.g.
http://169.254.169.254/), internal admin interfaces, or other services. The attacker cannot read the response content, but the request itself may have side effects depending on the target. - Error-based information disclosure. Wrapped Go HTTP client errors in the
Detailfield expose internal hostnames, IP addresses, port numbers, and network topology details. - Memory exhaustion. The unbounded
io.ReadAllon the response body allows an attacker to pointIssuingCertificateURLat a large resource, forcing the server to buffer it entirely in memory.
Patches
Fixed in #25274 (commit 57b11d405):
The fix was backported to all supported release lines:
| Release line | Patched version |
|---|---|
| 2.33 | v2.33.3 |
| 2.32 | v2.32.2 |
| 2.31 | v2.31.12 |
| 2.30 | v2.30.8 |
| 2.29 | v2.29.13 |
| 2.24 (ESR) | v2.24.5 |
Workarounds
If the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (/api/v2/workspaceagents/azure-instance-identity) using ingress firewall and/or proxy ACLs.
Recognition
We'd like to thank Ben Tran of calif.io and Anthropic's Security Team (ANT-2026-22447) for independently disclosing this issue!
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.33.0-rc.0"
},
{
"fixed": "2.33.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.32.0-rc.0"
},
{
"fixed": "2.32.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.31.0"
},
{
"fixed": "2.31.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.30.0"
},
{
"fixed": "2.30.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.29.0"
},
{
"fixed": "2.29.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.24.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.27.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45796"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-19T19:53:51Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nUnauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target\u0027s response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred.\n\n## Details\n\nThe `POST /api/v2/workspaceagents/azure-instance-identity` endpoint accepts a PKCS#7 signature without authentication. During certificate chain verification, [`azureidentity.Validate()`](https://github.com/coder/coder/blob/aa0e288b88/coderd/azureidentity/azureidentity.go#L83-L88) iterates over the signer certificate\u0027s `IssuingCertificateURL` extension and fetches each URL using `http.DefaultClient` with no host restriction, no private-IP blocking, and no response-size limit.\n\nAn attacker crafts a self-signed certificate whose Common Name matches `*.metadata.azure.com` (passing the `allowedSigners` regex) and whose `IssuingCertificateURL` points to an attacker-chosen target. The server fetches that URL and feeds the response body into `x509.ParseCertificate`. The parsed result is discarded, but the wrapped error string is returned verbatim in the JSON response via `Detail: err.Error()`. Connection-level errors (\"connection refused\", \"i/o timeout\", DNS failures) and certificate-parse errors give the attacker enough signal to infer host reachability and port state without seeing the actual response content.\n\n**Root causes:**\n\n1. No allowlist on `IssuingCertificateURL` hosts. Any URL was accepted.\n2. `http.DefaultClient` was used. It follows redirects and connects to private, link-local, and loopback addresses.\n3. Unbounded `io.ReadAll` on the response body (memory exhaustion vector).\n4. Raw `err.Error()` was returned in the JSON response, leaking internal HTTP client errors to the caller.\n\n## Impact\n\nThis is a semi-blind SSRF: the server makes the outbound request but the HTTP response body is consumed by `x509.ParseCertificate` and never returned to the attacker.\n\n- **Internal network reconnaissance.** The attacker can map internal hosts and ports by observing error differentiation in the API response: \"connection refused\" (port closed), \"i/o timeout\" (host unreachable or firewalled), DNS failure (host does not exist), or certificate-parse error (port open and responding). This enables systematic scanning of the internal network from the Coder server\u0027s vantage point.\n- **Requests to sensitive endpoints.** The server can be directed to hit cloud metadata services (e.g. `http://169.254.169.254/`), internal admin interfaces, or other services. The attacker cannot read the response content, but the request itself may have side effects depending on the target.\n- **Error-based information disclosure.** Wrapped Go HTTP client errors in the `Detail` field expose internal hostnames, IP addresses, port numbers, and network topology details.\n- **Memory exhaustion.** The unbounded `io.ReadAll` on the response body allows an attacker to point `IssuingCertificateURL` at a large resource, forcing the server to buffer it entirely in memory.\n\n## Patches\n\nFixed in [#25274](https://github.com/coder/coder/pull/25274) (commit [`57b11d405`](https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8)):\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.33 | [v2.33.3](https://github.com/coder/coder/releases/tag/v2.33.3) |\n| 2.32 | [v2.32.2](https://github.com/coder/coder/releases/tag/v2.32.2) |\n| 2.31 | [v2.31.12](https://github.com/coder/coder/releases/tag/v2.31.12) |\n| 2.30 | [v2.30.8](https://github.com/coder/coder/releases/tag/v2.30.8) |\n| 2.29 | [v2.29.13](https://github.com/coder/coder/releases/tag/v2.29.13) |\n| 2.24 (ESR) | [v2.24.5](https://github.com/coder/coder/releases/tag/v2.24.5) |\n\n## Workarounds\n\nIf the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.\n\n### Recognition\n\nWe\u0027d like to thank [Ben Tran](https://github.com/bencalif) of [calif.io](http://calif.io/) and Anthropic\u0027s Security Team (`ANT-2026-22447`) for independently disclosing this issue!",
"id": "GHSA-686c-7vgv-v3fx",
"modified": "2026-05-19T19:53:51Z",
"published": "2026-05-19T19:53:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fx"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/25274"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8"
},
{
"type": "PACKAGE",
"url": "https://github.com/coder/coder"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.24.5"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.29.13"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.30.8"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.31.12"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.32.2"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/releases/tag/v2.33.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint"
}
GHSA-687C-PPPW-76H3
Vulnerability from github – Published: 2026-07-20 21:31 – Updated: 2026-07-20 21:31HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-63731"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T19:17:29Z",
"severity": "MODERATE"
},
"details": "HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.",
"id": "GHSA-687c-pppw-76h3",
"modified": "2026-07-20T21:31:49Z",
"published": "2026-07-20T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63731"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/issues/2588"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/pull/2593"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hyperdx-ssrf-via-clickhouse-proxy-test-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-687H-XW6F-Q2QW
Vulnerability from github – Published: 2026-05-06 23:43 – Updated: 2026-06-09 01:59Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "PlaywrightCapture"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.39.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44439"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T23:43:36Z",
"nvd_published_at": "2026-05-13T22:16:44Z",
"severity": "MODERATE"
},
"details": "Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.",
"id": "GHSA-687h-xw6f-q2qw",
"modified": "2026-06-09T01:59:13Z",
"published": "2026-05-06T23:43:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44439"
},
{
"type": "WEB",
"url": "https://github.com/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405"
},
{
"type": "PACKAGE",
"url": "https://github.com/Lookyloo/PlaywrightCapture"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Playwright Capture permits access to local files and internal network resources during page capture"
}
GHSA-68CF-J696-WVV9
Vulnerability from github – Published: 2025-06-10 20:17 – Updated: 2025-06-10 20:17Summary
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.
Mitigation
To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.
Resolution
The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.
References
- CVE-2024-29198 Unauthenticated SSRF via TestWfsPost
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-10T20:17:58Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nMissing checks allow for SSRF to specific targets using the TestWfsPost enpoint. \n\n### Mitigation\n\nTo manage the proxy base value as a system administrator, use the parameter ``PROXY_BASE_URL`` to provide a non-empty value that cannot be overridden by the user interface or incoming request.[thomsmith](https://github.com/thomsmith).\n\n### Resolution\n\nThe TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript [Demo Requests](https://docs.geoserver.org/latest/en/user/configuration/demos/index.html#demo-requests) page to test OGC Web Services.\n\n### References\n\n* [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost",
"id": "GHSA-68cf-j696-wvv9",
"modified": "2025-06-10T20:17:58Z",
"published": "2025-06-10T20:17:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw"
},
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9"
},
{
"type": "PACKAGE",
"url": "https://github.com/geoserver/geoserver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx"
}
GHSA-68CQ-25F3-7RG7
Vulnerability from github – Published: 2025-09-03 15:30 – Updated: 2026-04-01 18:36Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.
{
"affected": [],
"aliases": [
"CVE-2025-58615"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T15:15:43Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.",
"id": "GHSA-68cq-25f3-7rg7",
"modified": "2026-04-01T18:36:02Z",
"published": "2025-09-03T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58615"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-bannerize-pro/vulnerability/wordpress-wp-bannerize-pro-plugin-1-10-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G7-C8WC-89PQ
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-16 15:30Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.
{
"affected": [],
"aliases": [
"CVE-2026-32357"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:49Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through \u003c= 2.37.",
"id": "GHSA-68g7-c8wc-89pq",
"modified": "2026-03-16T15:30:35Z",
"published": "2026-03-13T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32357"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G8-C275-XF2M
Vulnerability from github – Published: 2024-09-18 17:42 – Updated: 2024-09-18 19:25Impact
If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices (like 127.0.0.2 - 127.127.127.127)
Workaround
You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just 127.0.0.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.13.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "22.0.0"
},
{
"fixed": "22.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-46990"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-18T17:42:05Z",
"nvd_published_at": "2024-09-18T17:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nIf you\u0027re relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)\n\n### Workaround\nYou can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.\n\n",
"id": "GHSA-68g8-c275-xf2m",
"modified": "2024-09-18T19:25:25Z",
"published": "2024-09-18T17:42:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46990"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Directus vulnerable to SSRF Loopback IP filter bypass"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.