CWE-918 · Server-Side Request Forgery (SSRF) (page 16)
Page 16 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55150 | High | 8.6 | 2025-08-11 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf… |
CVE-2025-25235 | High | 8.6 | 2025-08-11 | Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows ro… |
CVE-2025-25229 | Medium | 5.4 | 2025-08-11 | Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted… |
CVE-2025-8772 | Medium | 4.3 | 2025-08-09 | A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /… |
CVE-2025-4655 | Medium | 5.0 | 2025-08-09 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7… |
CVE-2025-4581 | High | 8.6 | 2025-08-09 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-53767 | Critical | 10.0 | 2025-08-07 | Azure OpenAI Elevation of Privilege Vulnerability |
CVE-2025-51058 | Medium | 6.5 | 2025-08-06 | Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote aut… |
CVE-2024-55399 | Medium | 6.5 | 2025-08-06 | 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). |
CVE-2025-50234 | Medium | 6.5 | 2025-08-06 | MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic… |
CVE-2025-8529 | Medium | 6.3 | 2025-08-04 | A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl… |
CVE-2025-8527 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/mai… |
CVE-2025-8520 | Medium | 4.7 | 2025-08-04 | A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/edi… |
CVE-2025-8341 | Medium | 5.0 | 2025-08-04 | Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from J… |
CVE-2025-54132 | Medium | 4.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get… |
CVE-2025-54590 | | 2025-08-01 | webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accep… | |
CVE-2025-52567 | Low | 3.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 t… |
CVE-2025-54381 | Critical | 9.9 | 2025-07-29 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload proc… |
CVE-2025-24485 | Medium | 5.8 | 2025-07-28 | A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead… |
CVE-2025-8267 | High | 8.2 | 2025-07-28 | Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifi… |
CVE-2025-8228 | Medium | 6.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function getPages of the file /cms/… |
CVE-2025-52455 | Medium | 5.3 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This is… |
CVE-2025-52454 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing… |
CVE-2025-52453 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. T… |
CVE-2025-45939 | Medium | 6.5 | 2025-07-25 | Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function. |
CVE-2025-8133 | Medium | 6.3 | 2025-07-25 | A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/ser… |
CVE-2025-8020 | High | 8.2 | 2025-07-23 | All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a… |
CVE-2025-5818 | Medium | 5.5 | 2025-07-23 | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includin… |
CVE-2025-54122 | Critical | 10.0 | 2025-07-21 | Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the pro… |
CVE-2025-52362 | Critical | 9.1 | 2025-07-21 | Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _p… |
CVE-2025-36845 | High | 8.6 | 2025-07-21 | An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint t… |
CVE-2025-46385 | High | 8.6 | 2025-07-20 | CWE-918 Server-Side Request Forgery (SSRF) |
CVE-2025-52163 | Medium | 6.5 | 2025-07-18 | A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully… |
CVE-2025-7787 | Medium | 6.3 | 2025-07-18 | A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\… |
CVE-2025-7759 | Medium | 6.3 | 2025-07-17 | A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/com… |
CVE-2025-20288 | Medium | 5.8 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-… |
CVE-2024-9408 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. |
CVE-2025-48294 | Medium | 4.4 | 2025-07-16 | Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Dru… |
CVE-2025-1220 | Low | 3.7 | 2025-07-13 | In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hos… |
CVE-2025-53641 | High | 8.2 | 2025-07-11 | Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into t… |
CVE-2025-51591 | Low | 3.7 | 2025-07-11 | A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted if… |
CVE-2025-50125 | | 2025-07-11 | A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via th… | |
CVE-2025-6851 | High | 7.2 | 2025-07-11 | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() fu… |
CVE-2025-53371 | Critical | 9.1 | 2025-07-10 | DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending r… |
CVE-2024-43394 | High | 7.5 | 2025-07-10 | Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache exp… |
CVE-2024-43204 | High | 7.5 | 2025-07-10 | SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely… |
CVE-2025-49545 | Medium | 6.2 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file s… |
CVE-2025-0292 | Medium | 5.5 | 2025-07-08 | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights… |
CVE-2025-42965 | Medium | 4.1 | 2025-07-08 | SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configurat… |
CVE-2025-53473 | High | 7.3 | 2025-07-07 | Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended reque… |
CVE-2025-7103 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/cont… |
CVE-2025-49418 | High | 7.2 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allmart-core allows Server Side Request Forgery.This issue affects Allmart: from n/a t… |
CVE-2025-28963 | Medium | 5.4 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Server Side Request Forgery.This issue affects URL Sho… |
CVE-2025-6729 | Medium | 6.4 | 2025-07-04 | The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_p… |
CVE-2025-5817 | High | 7.2 | 2025-07-02 | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w… |
CVE-2025-34051 | | 2025-07-01 | A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_q… | |
CVE-2025-45872 | Critical | 9.8 | 2025-07-01 | zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. |
CVE-2025-52491 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. |
CVE-2025-53018 | Low | 3.0 | 2025-06-27 | Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v… |
CVE-2025-6762 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP H… |
CVE-2025-2940 | High | 7.2 | 2025-06-27 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via t… |
CVE-2025-52477 | High | 8.6 | 2025-06-26 | Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SS… |
CVE-2024-51981 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request… |
CVE-2024-51980 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port n… |
CVE-2025-49852 | High | 7.5 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated a… |
CVE-2025-2828 | Critical | 10.0 | 2025-06-23 | A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_communit… |
CVE-2025-6517 | Medium | 6.3 | 2025-06-23 | A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\… |
CVE-2025-52967 | Medium | 5.8 | 2025-06-23 | gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation. |
CVE-2025-34021 | | 2025-06-20 | A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Sempl… | |
CVE-2025-52713 | Medium | 6.4 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This is… |
CVE-2025-49985 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto… |
CVE-2025-49984 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress P… |
CVE-2025-49983 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through… |
CVE-2025-47293 | | 2025-06-19 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vu… | |
CVE-2025-23172 | High | 7.2 | 2025-06-19 | The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" an… |
CVE-2025-30680 | High | 7.1 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to infor… |
CVE-2025-30679 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain par… |
CVE-2025-30678 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain par… |
CVE-2025-49877 | Medium | 4.9 | 2025-06-17 | Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery… |
CVE-2025-6142 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-6087 | Critical | 9.1 | 2025-06-16 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature… |
CVE-2025-49190 | Medium | 4.3 | 2025-06-12 | The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports. |
CVE-2023-48786 | Medium | 4.3 | 2025-06-10 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attack… |
CVE-2025-44043 | Medium | 5.4 | 2025-06-10 | Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyo… |
CVE-2025-30220 | Critical | 9.9 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema da… |
CVE-2024-40625 | Medium | 5.5 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{store… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2024-29198 | High | 7.5 | 2025-06-10 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Fo… |
CVE-2025-27817 | High | 7.5 | 2025-06-10 | A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting th… |
CVE-2025-42988 | Low | 3.7 | 2025-06-10 | Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal ne… |
CVE-2025-30997 | Medium | 5.4 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects… |
CVE-2025-30976 | Medium | 4.9 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a… |
CVE-2025-29008 | Medium | 4.9 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a… |
CVE-2025-46341 | High | 7.1 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any… |
CVE-2025-48962 | Medium | 4.3 | 2025-06-04 | Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938. |
CVE-2025-5510 | Medium | 6.3 | 2025-06-03 | A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/opt… |
CVE-2024-7073 | Medium | 6.5 | 2025-06-02 | A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows u… |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5327 | Medium | 6.3 | 2025-05-29 | A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php… |
CVE-2025-4967 | Critical | 9.1 | 2025-05-29 | Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections. |