CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4931 vulnerabilities reference this CWE, most recent first.
GHSA-X8XM-HQH8-G7PW
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2024-04-04 00:42WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).
{
"affected": [],
"aliases": [
"CVE-2019-12161"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-17T19:29:00Z",
"severity": "HIGH"
},
"details": "WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).",
"id": "GHSA-x8xm-hqh8-g7pw",
"modified": "2024-04-04T00:42:20Z",
"published": "2022-05-24T16:46:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12161"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1550366"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X8XQ-5829-HC86
Vulnerability from github – Published: 2025-09-14 06:30 – Updated: 2025-09-14 06:30A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-10393"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-14T06:15:29Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.",
"id": "GHSA-x8xq-5829-hc86",
"modified": "2025-09-14T06:30:20Z",
"published": "2025-09-14T06:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10393"
},
{
"type": "WEB",
"url": "https://github.com/miurla/morphic/issues/670"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323828"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323828"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.645509"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X9CC-G7V6-8MC3
Vulnerability from github – Published: 2025-07-04 09:31 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7.
{
"affected": [],
"aliases": [
"CVE-2025-28963"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-04T09:15:30Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7.",
"id": "GHSA-x9cc-g7v6-8mc3",
"modified": "2026-04-01T18:35:41Z",
"published": "2025-07-04T09:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28963"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-plugin-3-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9CC-HF3V-Q44R
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2025-05-08 12:34Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
{
"affected": [],
"aliases": [
"CVE-2020-17386"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-25T08:15:00Z",
"severity": "MODERATE"
},
"details": "Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.",
"id": "GHSA-x9cc-hf3v-q44r",
"modified": "2025-05-08T12:34:28Z",
"published": "2022-05-24T17:26:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17386"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9FW-V6JG-W952
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2021-34808"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-18T03:15:00Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.",
"id": "GHSA-x9fw-v6jg-w952",
"modified": "2022-05-24T19:05:40Z",
"published": "2022-05-24T19:05:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34808"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_21_10"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X9W3-4P72-R5RX
Vulnerability from github – Published: 2026-03-09 18:31 – Updated: 2026-03-09 18:31A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.
{
"affected": [],
"aliases": [
"CVE-2026-3588"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-09T16:16:21Z",
"severity": "HIGH"
},
"details": "A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.",
"id": "GHSA-x9w3-4p72-r5rx",
"modified": "2026-03-09T18:31:43Z",
"published": "2026-03-09T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3588"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-3588"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X9WP-HPRC-2GVQ
Vulnerability from github – Published: 2022-03-22 00:00 – Updated: 2022-03-29 00:01The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
{
"affected": [],
"aliases": [
"CVE-2022-0591"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-21T19:15:00Z",
"severity": "CRITICAL"
},
"details": "The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users",
"id": "GHSA-x9wp-hprc-2gvq",
"modified": "2022-03-29T00:01:25Z",
"published": "2022-03-22T00:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0591"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XC4W-H9RQ-68JX
Vulnerability from github – Published: 2022-05-17 02:50 – Updated: 2022-05-17 02:50In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.
{
"affected": [],
"aliases": [
"CVE-2017-7569"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-06T17:59:00Z",
"severity": "HIGH"
},
"details": "In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.",
"id": "GHSA-xc4w-h9rq-68jx",
"modified": "2022-05-17T02:50:38Z",
"published": "2022-05-17T02:50:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7569"
},
{
"type": "WEB",
"url": "https://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4367744-vbulletin-5-3-0-connect-is-now-available"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XC69-C397-P3R8
Vulnerability from github – Published: 2023-04-21 18:30 – Updated: 2024-04-04 03:38A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022
could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
{
"affected": [],
"aliases": [
"CVE-2023-2140"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-21T16:15:07Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n",
"id": "GHSA-xc69-c397-p3r8",
"modified": "2024-04-04T03:38:09Z",
"published": "2023-04-21T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2140"
},
{
"type": "WEB",
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XC93-Q32J-CPCG
Vulnerability from github – Published: 2025-11-04 14:30 – Updated: 2025-11-07 16:40Impact
The /api/images/cache which is used to download media posters from the server accepted an url parameter, which was directly passed to the cache package and that downloaded the poster from this URL.
This URL parameter can be used to make the jellysweep server download arbitrary content.
The API endpoint can only be used by authenticated users.
Patches
Fixed in v0.13.0. The affected (and now fixed) library was also moved to internal/ because it wasn't meant to be imported.
References
https://github.com/jon4hz/jellysweep/security/code-scanning/28
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/jon4hz/jellysweep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64178"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-04T14:30:22Z",
"nvd_published_at": "2025-11-06T22:15:44Z",
"severity": "HIGH"
},
"details": "### Impact\nThe `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL.\nThis URL parameter can be used to make the jellysweep server download arbitrary content.\n\nThe API endpoint can only be used by authenticated users.\n\n### Patches\n\nFixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn\u0027t meant to be imported.\n\n\n### References\nhttps://github.com/jon4hz/jellysweep/security/code-scanning/28",
"id": "GHSA-xc93-q32j-cpcg",
"modified": "2025-11-07T16:40:49Z",
"published": "2025-11-04T14:30:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64178"
},
{
"type": "WEB",
"url": "https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101"
},
{
"type": "PACKAGE",
"url": "https://github.com/jon4hz/jellysweep"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Jellysweep uses uncontrolled data in image cache API endpoint"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.