CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4733 vulnerabilities reference this CWE, most recent first.
GHSA-J9FQ-VWQV-2FM2
Vulnerability from github – Published: 2022-09-15 00:00 – Updated: 2023-06-21 18:10Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2900"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-15T16:17:41Z",
"nvd_published_at": "2022-09-14T11:15:00Z",
"severity": "CRITICAL"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.",
"id": "GHSA-j9fq-vwqv-2fm2",
"modified": "2023-06-21T18:10:04Z",
"published": "2022-09-15T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2900"
},
{
"type": "WEB",
"url": "https://github.com/ionicabizau/parse-url/commit/b88c81df8f4c5168af454eaa4f92afa9349e4e13"
},
{
"type": "PACKAGE",
"url": "https://github.com/IonicaBizau/parse-url"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url"
}
GHSA-J9GJ-58QX-H9VW
Vulnerability from github – Published: 2023-05-31 15:30 – Updated: 2023-05-31 15:30A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
{
"affected": [],
"aliases": [
"CVE-2023-3015"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T14:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.",
"id": "GHSA-j9gj-58qx-h9vw",
"modified": "2023-05-31T15:30:20Z",
"published": "2023-05-31T15:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3015"
},
{
"type": "WEB",
"url": "https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/VIP-video-analysis/SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230359"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J9MG-7MRV-2WWC
Vulnerability from github – Published: 2026-07-02 15:32 – Updated: 2026-07-02 15:32A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
{
"affected": [],
"aliases": [
"CVE-2026-54401"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T15:17:03Z",
"severity": "HIGH"
},
"details": "A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.",
"id": "GHSA-j9mg-7mrv-2wwc",
"modified": "2026-07-02T15:32:12Z",
"published": "2026-07-02T15:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54401"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9PJ-HX76-92V6
Vulnerability from github – Published: 2021-05-10 18:38 – Updated: 2021-04-21 20:55This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "phantomjs-seo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7739"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-21T20:55:27Z",
"nvd_published_at": "2020-10-06T15:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.",
"id": "GHSA-j9pj-hx76-92v6",
"modified": "2021-04-21T20:55:27Z",
"published": "2021-05-10T18:38:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7739"
},
{
"type": "WEB",
"url": "https://github.com/areverberi/phantomjs-seo/blob/083f66892f97d67031668decb917389ffc32a94c/index.js%23L17"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PHANTOMJSSEO-609638"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/phantomjs-seo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in phantomjs-seo"
}
GHSA-J9X3-MX4X-WH8R
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2026-06-22 21:30MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
{
"affected": [],
"aliases": [
"CVE-2020-28043"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-02T21:15:00Z",
"severity": "HIGH"
},
"details": "MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.",
"id": "GHSA-j9x3-mx4x-wh8r",
"modified": "2026-06-22T21:30:42Z",
"published": "2022-05-24T17:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28043"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JC25-R723-4CF5
Vulnerability from github – Published: 2023-06-13 09:30 – Updated: 2024-04-04 04:45A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.
{
"affected": [],
"aliases": [
"CVE-2023-25609"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-13T09:15:16Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability\u00a0[CWE-918] in\u00a0FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.",
"id": "GHSA-jc25-r723-4cf5",
"modified": "2024-04-04T04:45:30Z",
"published": "2023-06-13T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25609"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-22-493"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JC3M-32W2-FFJC
Vulnerability from github – Published: 2025-08-14 12:30 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward allows Server Side Request Forgery. This issue affects PressForward: from n/a through 5.9.1.
{
"affected": [],
"aliases": [
"CVE-2025-28987"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T11:15:31Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward allows Server Side Request Forgery. This issue affects PressForward: from n/a through 5.9.1.",
"id": "GHSA-jc3m-32w2-ffjc",
"modified": "2026-04-01T18:35:48Z",
"published": "2025-08-14T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28987"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/pressforward/vulnerability/wordpress-pressforward-5-8-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JCPJ-R94H-977W
Vulnerability from github – Published: 2026-04-27 21:31 – Updated: 2026-04-27 21:31A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-7147"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-27T19:16:53Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-jcpj-r94h-977w",
"modified": "2026-04-27T21:31:03Z",
"published": "2026-04-27T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7147"
},
{
"type": "WEB",
"url": "https://github.com/JoeCastrom/mcp-chat-studio/issues/4"
},
{
"type": "WEB",
"url": "https://github.com/JoeCastrom/mcp-chat-studio"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/801896"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359746"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359746/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JCW2-6V8C-W2H9
Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2026-04-08 21:32The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2024-1467"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T14:47:31Z",
"severity": "MODERATE"
},
"details": "The Starter Templates \u2014 Elementor, WordPress \u0026 Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-jcw2-6v8c-w2h9",
"modified": "2026-04-08T21:32:35Z",
"published": "2024-05-14T15:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1467"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites-importer.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5075f9-9658-4a09-bd38-34a72f6560f4?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JF2M-JHCF-5XQG
Vulnerability from github – Published: 2021-12-23 00:01 – Updated: 2024-03-21 03:34Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF)
{
"affected": [],
"aliases": [
"CVE-2021-44659"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-22T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF)",
"id": "GHSA-jf2m-jhcf-5xqg",
"modified": "2024-03-21T03:34:09Z",
"published": "2021-12-23T00:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44659"
},
{
"type": "WEB",
"url": "https://github.com/Mesh3l911/CVE-2021-44659"
},
{
"type": "WEB",
"url": "https://github.com/gocd/gocd"
},
{
"type": "WEB",
"url": "https://www.gocd.org"
},
{
"type": "WEB",
"url": "https://youtu.be/WW_a3znugl0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.