CWE-918 · Server-Side Request Forgery (SSRF) (page 15)
Page 15 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34231 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34230 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34229 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34228 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34225 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-11046 | High | 7.3 | 2025-09-26 | A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. T… |
CVE-2025-60181 | Medium | 5.4 | 2025-09-26 | Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Si… |
CVE-2025-60161 | Medium | 5.4 | 2025-09-26 | Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a t… |
CVE-2025-10137 | Medium | 5.4 | 2025-09-26 | The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This… |
CVE-2020-36851 | | 2025-09-25 | Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets… | |
CVE-2025-42907 | Medium | 4.3 | 2025-09-23 | SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server… |
CVE-2025-59527 | High | 7.5 | 2025-09-22 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability w… |
CVE-2025-9960 | | 2025-09-22 | A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affects is-localhost-ip… | |
CVE-2025-58962 | Medium | 6.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through… |
CVE-2025-58011 | Medium | 6.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a… |
CVE-2025-58005 | Medium | 5.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: fr… |
CVE-2025-57984 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.Thi… |
CVE-2025-57943 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Server Side Request Forgery.This issue affect… |
CVE-2025-53461 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a… |
CVE-2025-53457 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affe… |
CVE-2025-36037 | Medium | 5.4 | 2025-09-22 | IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-10787 | Medium | 6.3 | 2025-09-22 | A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performi… |
CVE-2025-10765 | Medium | 4.7 | 2025-09-21 | A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroo… |
CVE-2025-10764 | Medium | 6.3 | 2025-09-21 | A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskControl… |
CVE-2025-10760 | Medium | 6.3 | 2025-09-21 | A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of… |
CVE-2025-26515 | High | 7.5 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request… |
CVE-2025-59344 | High | 7.7 | 2025-09-19 | AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extractio… |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-59346 | Medium | 5.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vul… |
CVE-2025-9862 | Medium | 6.5 | 2025-09-17 | Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, f… |
CVE-2025-57055 | Medium | 6.5 | 2025-09-17 | WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply… |
CVE-2025-59437 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic… |
CVE-2025-59436 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable v… |
CVE-2025-59155 | | 2025-09-15 | hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains… | |
CVE-2025-10471 | Medium | 6.3 | 2025-09-15 | A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of… |
CVE-2025-58045 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserializa… |
CVE-2025-10453 | Medium | 5.3 | 2025-09-15 | O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this… |
CVE-2025-10410 | Medium | 6.3 | 2025-09-14 | A security vulnerability has been detected in SourceCodester Link Status Checker 1.0. This vulnerability affects unknown code of the file index.php. The manipu… |
CVE-2025-10397 | Medium | 4.7 | 2025-09-14 | A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument… |
CVE-2025-10395 | Medium | 4.7 | 2025-09-14 | A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler… |
CVE-2025-10393 | Medium | 6.3 | 2025-09-14 | A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx… |
CVE-2025-10391 | Medium | 6.3 | 2025-09-14 | A security vulnerability has been detected in CRMEB up to 5.6.1. The impacted element is the function testOutUrl of the file app/services/out/OutAccountService… |
CVE-2025-10329 | Medium | 6.3 | 2025-09-12 | A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of th… |
CVE-2025-6454 | High | 8.5 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowe… |
CVE-2025-59055 | Medium | 4.7 | 2025-09-11 | InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17… |
CVE-2025-10211 | Medium | 6.3 | 2025-09-10 | A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getAr… |
CVE-2025-7843 | Medium | 6.4 | 2025-09-10 | The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetc… |
CVE-2025-44594 | Critical | 9.1 | 2025-09-09 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. |
CVE-2025-9269 | | 2025-09-09 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leverag… | |
CVE-2025-5005 | High | 7.3 | 2025-09-09 | A vulnerability was detected in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. This affects an unknown function of the file crm/WeiXinApp… |
CVE-2025-58977 | Medium | 4.9 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue aff… |
CVE-2025-54249 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security featu… |
CVE-2025-49430 | High | 7.2 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video… |
CVE-2025-47437 | Medium | 6.4 | 2025-09-09 | Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through… |
CVE-2025-55139 | Medium | 6.8 | 2025-09-09 | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-9065 | High | 8.8 | 2025-09-09 | A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attac… |
CVE-2025-43763 | Medium | 6.5 | 2025-09-09 | A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0… |
CVE-2025-10096 | Medium | 6.3 | 2025-09-08 | A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing ma… |
CVE-2025-8085 | High | 8.6 | 2025-09-08 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors t… |
CVE-2025-58829 | Medium | 4.9 | 2025-09-05 | Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Serv… |
CVE-2025-58179 | High | 7.2 | 2025-09-05 | Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configu… |
CVE-2025-58641 | Medium | 5.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit I… |
CVE-2025-58615 | Medium | 4.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Banneri… |
CVE-2025-9821 | Low | 2.7 | 2025-09-03 | SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also d… |
CVE-2025-9805 | Medium | 6.3 | 2025-09-02 | A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/ap… |
CVE-2025-9799 | Medium | 5.0 | 2025-09-01 | A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/feat… |
CVE-2025-55007 | Low | 3.5 | 2025-09-01 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnera… |
CVE-2025-57822 | Medium | 6.5 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing th… |
CVE-2025-53250 | Medium | 6.4 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat chartbeat allows Server Side Request Forgery.This issue affects Chartbeat: from n/a thr… |
CVE-2025-48364 | Medium | 4.9 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through <= 0.4.2. |
CVE-2025-58203 | Medium | 4.4 | 2025-08-27 | Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from… |
CVE-2025-57818 | Medium | 6.3 | 2025-08-26 | Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was disc… |
CVE-2025-57814 | | 2025-08-25 | request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerab… | |
CVE-2025-9414 | Medium | 4.7 | 2025-08-25 | A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of… |
CVE-2024-46413 | Medium | 5.1 | 2025-08-25 | Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loa… |
CVE-2025-54370 | | 2025-08-25 | PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can… | |
CVE-2025-9402 | Medium | 4.7 | 2025-08-25 | A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Co… |
CVE-2025-9395 | Medium | 6.3 | 2025-08-24 | A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileN… |
CVE-2025-7813 | High | 7.2 | 2025-08-23 | The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… |
CVE-2025-8678 | Medium | 5.9 | 2025-08-22 | The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This… |
CVE-2025-43747 | Medium | 6.5 | 2025-08-21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.d… |
CVE-2025-47700 | Low | 3.5 | 2025-08-21 | Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking mal… |
CVE-2025-27217 | Critical | 9.1 | 2025-08-21 | A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application… |
CVE-2025-1142 | Medium | 5.4 | 2025-08-20 | IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests fr… |
CVE-2025-54925 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the applica… |
CVE-2025-54924 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially craf… |
CVE-2025-5260 | High | 8.6 | 2025-08-20 | Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik On… |
CVE-2024-39954 | Medium | 6.3 | 2025-08-20 | CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functiona… |
CVE-2025-54234 | Low | 2.7 | 2025-08-18 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file sys… |
CVE-2025-8675 | High | 8.8 | 2025-08-15 | Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from… |
CVE-2025-8013 | Low | 3.8 | 2025-08-15 | The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunEx… |
CVE-2025-8680 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the… |
CVE-2025-53241 | Medium | 5.5 | 2025-08-14 | Server-Side Request Forgery (SSRF) vulnerability in kodeshpa Simplified simplified allows Server Side Request Forgery.This issue affects Simplified: from n/a t… |
CVE-2025-28987 | Medium | 6.4 | 2025-08-14 | Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward… |
CVE-2025-50251 | Critical | 9.1 | 2025-08-13 | Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. |
CVE-2025-53760 | High | 7.1 | 2025-08-12 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2025-7622 | Medium | 5.7 | 2025-08-12 | During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources… |
CVE-2025-55161 | High | 8.6 | 2025-08-11 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown… |
CVE-2025-55151 | High | 8.6 | 2025-08-11 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality… |
CVE-2025-55150 | High | 8.6 | 2025-08-11 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf… |