CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4757 vulnerabilities reference this CWE, most recent first.
GHSA-C8FR-PR74-J8MQ
Vulnerability from github – Published: 2025-04-15 12:30 – Updated: 2026-04-01 18:34Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons allows Server Side Request Forgery. This issue affects Royal Elementor Addons: from n/a through 1.7.1006.
{
"affected": [],
"aliases": [
"CVE-2025-26990"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T12:15:21Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons allows Server Side Request Forgery. This issue affects Royal Elementor Addons: from n/a through 1.7.1006.",
"id": "GHSA-c8fr-pr74-j8mq",
"modified": "2026-04-01T18:34:41Z",
"published": "2025-04-15T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26990"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1006-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C8J7-9PJJ-VHM4
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/init.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-4231"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:20:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-c8j7-9pjj-vhm4",
"modified": "2026-03-16T15:30:46Z",
"published": "2026-03-16T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4231"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/574542015755951ee1d53206022cc754"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.351154"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.351154"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.771217"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C8M8-4468-H6XX
Vulnerability from github – Published: 2026-04-06 06:30 – Updated: 2026-04-06 06:30A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-5623"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-06T06:16:19Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-c8m8-4468-h6xx",
"modified": "2026-04-06T06:30:29Z",
"published": "2026-04-06T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5623"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/785632"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355413"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355413/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C8QJ-JVPH-XJ8W
Vulnerability from github – Published: 2024-05-31 15:30 – Updated: 2024-05-31 15:30The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.0 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2023-7073"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-31T15:15:09Z",
"severity": "MODERATE"
},
"details": "The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.0 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-c8qj-jvph-xj8w",
"modified": "2024-05-31T15:30:37Z",
"published": "2024-05-31T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7073"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/3.9.18/includes/class-apt.php#L947"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc024183-0244-4ef9-9171-057ecd1c3e1d?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C928-5V6M-VM5H
Vulnerability from github – Published: 2025-03-29 00:31 – Updated: 2025-03-31 21:32maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
{
"affected": [],
"aliases": [
"CVE-2025-28089"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-28T22:15:17Z",
"severity": "CRITICAL"
},
"details": "maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.",
"id": "GHSA-c928-5v6m-vm5h",
"modified": "2025-03-31T21:32:45Z",
"published": "2025-03-29T00:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28089"
},
{
"type": "WEB",
"url": "https://github.com/magicblack/maccms10/releases/tag/v2025.1000.4047"
},
{
"type": "WEB",
"url": "https://www.yuque.com/morysummer/vx41bz/wzer7qxh0vwrf6zq"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C96R-38GV-GRP4
Vulnerability from github – Published: 2024-07-05 12:31 – Updated: 2024-07-08 19:04A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "shopxo/shopxo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-6524"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-08T19:04:34Z",
"nvd_published_at": "2024-07-05T12:15:02Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file `extend/base/Uploader.php`. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF.",
"id": "GHSA-c96r-38gv-grp4",
"modified": "2024-07-08T19:04:34Z",
"published": "2024-07-05T12:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6524"
},
{
"type": "WEB",
"url": "https://github.com/J1rrY-learn/learn/blob/main/shopxo_ssrf.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/gongfuxiang/shopxo"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.270367"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.270367"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.365173"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "ShopXO Server-Side Request Forgery Vulnerability"
}
GHSA-C9QC-5G7M-F8W6
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
{
"affected": [],
"aliases": [
"CVE-2021-41587"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-24T15:15:00Z",
"severity": "HIGH"
},
"details": "In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.",
"id": "GHSA-c9qc-5g7m-f8w6",
"modified": "2022-05-24T19:15:42Z",
"published": "2022-05-24T19:15:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41587"
},
{
"type": "WEB",
"url": "https://security.gradle.com/advisory/2021-04"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-C9XR-H75P-WMH5
Vulnerability from github – Published: 2022-05-18 00:00 – Updated: 2022-05-27 00:01Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
{
"affected": [],
"aliases": [
"CVE-2022-1711"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-17T13:15:00Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.",
"id": "GHSA-c9xr-h75p-wmh5",
"modified": "2022-05-27T00:01:08Z",
"published": "2022-05-18T00:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1711"
},
{
"type": "WEB",
"url": "https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654ae"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/c32afff5-6ad5-4d4d-beea-f55ab4925797"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CCCX-RCQV-GWFJ
Vulnerability from github – Published: 2022-05-17 02:14 – Updated: 2025-04-20 03:38XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.
{
"affected": [],
"aliases": [
"CVE-2017-9355"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T19:29:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.",
"id": "GHSA-cccx-rcqv-gwfj",
"modified": "2025-04-20T03:38:36Z",
"published": "2022-05-17T02:14:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9355"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42119"
},
{
"type": "WEB",
"url": "http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/142795/Subsonic-6.1.1-XML-External-Entity-Attack.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CCF7-RWQ8-4G7W
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-01-20 15:32Server-Side Request Forgery (SSRF) vulnerability in ThemesInflow Hercules Core hercules-core allows Server Side Request Forgery.This issue affects Hercules Core : from n/a through <= 7.4.
{
"affected": [],
"aliases": [
"CVE-2025-63010"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:18:06Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in ThemesInflow Hercules Core hercules-core allows Server Side Request Forgery.This issue affects Hercules Core : from n/a through \u003c= 7.4.",
"id": "GHSA-ccf7-rwq8-4g7w",
"modified": "2026-01-20T15:32:03Z",
"published": "2025-12-09T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63010"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/hercules-core/vulnerability/wordpress-hercules-core-plugin-7-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/hercules-core/vulnerability/wordpress-hercules-core-plugin-7-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.