CWE-918 · Server-Side Request Forgery (SSRF) (page 17)
Page 17 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-45474 | High | 7.3 | 2025-05-29 | maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings. |
CVE-2024-52588 | Medium | 4.9 | 2025-05-29 | Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetc… |
CVE-2025-5276 | High | 7.4 | 2025-05-29 | Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacke… |
CVE-2025-45475 | Medium | 5.4 | 2025-05-27 | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. |
CVE-2025-48383 | High | 8.2 | 2025-05-27 | Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and M… |
CVE-2025-5186 | Medium | 6.3 | 2025-05-26 | A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of… |
CVE-2025-5140 | Medium | 6.3 | 2025-05-25 | A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService… |
CVE-2025-48739 | | 2025-05-23 | A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1… | |
CVE-2024-13957 | High | 7.6 | 2025-05-22 | SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3… |
CVE-2025-47936 | Low | 3.3 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS… |
CVE-2025-36560 | High | 8.6 | 2025-05-19 | Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gai… |
CVE-2025-47791 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28… |
CVE-2024-6584 | Critical | 9.1 | 2025-05-15 | The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs. |
CVE-2025-40595 | High | 7.2 | 2025-05-14 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthe… |
CVE-2024-13940 | Medium | 5.5 | 2025-05-14 | The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook fun… |
CVE-2025-45887 | Critical | 9.1 | 2025-05-09 | Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent. |
CVE-2025-47733 | Critical | 9.1 | 2025-05-08 | Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network |
CVE-2025-29972 | Critical | 9.9 | 2025-05-08 | Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network. |
CVE-2025-47664 | Medium | 4.4 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2. |
CVE-2025-47635 | Medium | 5.5 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects Webinar… |
CVE-2025-47548 | Medium | 5.4 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allow… |
CVE-2025-47484 | Medium | 6.4 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.Thi… |
CVE-2025-47483 | Medium | 4.9 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in Iulia Cazan Easy Replace Image easy-replace-image allows Server Side Request Forgery.This issue affects Eas… |
CVE-2025-47464 | Medium | 4.9 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from… |
CVE-2025-45250 | Medium | 5.5 | 2025-05-06 | MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. |
CVE-2024-55910 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2024-48907 | High | 7.5 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. |
CVE-2025-46568 | High | 7.5 | 2025-05-01 | Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerabl… |
CVE-2024-13845 | Medium | 5.5 | 2025-05-01 | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed'… |
CVE-2025-2170 | High | 7.2 | 2025-04-30 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potent… |
CVE-2023-35817 | Medium | 5.0 | 2025-04-28 | DevExpress before 23.1.3 allows AsyncDownloader SSRF. |
CVE-2025-4012 | Low | 2.7 | 2025-04-28 | A vulnerability was found in playeduxyz PlayEdu 开源培训系统 up to 1.8 and classified as problematic. This issue affects some unknown processing of the file /api/bac… |
CVE-2025-3954 | Low | 3.7 | 2025-04-26 | A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component… |
CVE-2025-3775 | Medium | 6.5 | 2025-04-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Ser… |
CVE-2025-46531 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery… |
CVE-2025-46511 | Medium | 6.4 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects Be… |
CVE-2025-46503 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue a… |
CVE-2025-46443 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <… |
CVE-2025-1522 | Medium | 6.5 | 2025-04-23 | PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2025-1521 | Medium | 6.5 | 2025-04-23 | PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensiti… |
CVE-2025-27907 | Medium | 4.1 | 2025-04-22 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-2987 | Low | 3.8 | 2025-04-22 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests… |
CVE-2025-28197 | Critical | 9.1 | 2025-04-18 | Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. |
CVE-2025-3787 | Low | 2.7 | 2025-04-18 | A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipul… |
CVE-2025-29461 | High | 7.6 | 2025-04-17 | An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path. |
CVE-2025-29460 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the a… |
CVE-2025-29459 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed… |
CVE-2025-29458 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of th… |
CVE-2025-29457 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of t… |
CVE-2025-29456 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function. |
CVE-2025-29453 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings… |
CVE-2025-29455 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" functio… |
CVE-2025-29454 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function. |
CVE-2025-29452 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component. |
CVE-2025-29451 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component. |
CVE-2025-29450 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component. |
CVE-2025-29449 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function. |
CVE-2024-56736 | Medium | 6.5 | 2025-04-16 | Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended t… |
CVE-2025-3691 | Low | 2.7 | 2025-04-16 | A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add… |
CVE-2025-32102 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterfac… |
CVE-2025-30964 | Medium | 5.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from… |
CVE-2025-26990 | Medium | 4.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affect… |
CVE-2025-31490 | High | 7.5 | 2025-04-14 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-29720 | Medium | 4.8 | 2025-04-14 | Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. |
CVE-2025-3572 | High | 7.5 | 2025-04-14 | SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access ar… |
CVE-2025-22374 | | 2025-04-10 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1… | |
CVE-2025-0539 | High | 8.8 | 2025-04-10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo… |
CVE-2025-32691 | Medium | 4.9 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress P… |
CVE-2025-32675 | Medium | 6.8 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a thr… |
CVE-2025-32487 | Medium | 4.9 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5… |
CVE-2025-31009 | Medium | 5.4 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from… |
CVE-2025-32372 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously k… |
CVE-2025-3412 | Medium | 6.3 | 2025-04-08 | A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/tra… |
CVE-2025-3411 | Medium | 6.3 | 2025-04-08 | A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_p… |
CVE-2025-32013 | High | 7.5 | 2025-04-06 | LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handli… |
CVE-2025-32358 | Medium | 4.0 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain condit… |
CVE-2025-3254 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipu… |
CVE-2025-2245 | Medium | 5.3 | 2025-04-04 | A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component o… |
CVE-2025-2243 | High | 7.3 | 2025-04-04 | A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading charact… |
CVE-2025-3192 | High | 8.2 | 2025-04-04 | Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restrictio… |
CVE-2025-31824 | Medium | 5.4 | 2025-04-01 | Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin… |
CVE-2025-31796 | Medium | 5.4 | 2025-04-01 | Server-Side Request Forgery (SSRF) vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue… |
CVE-2025-21384 | High | 8.3 | 2025-04-01 | An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network. |
CVE-2025-31117 | High | 7.5 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF)… |
CVE-2025-31116 | Medium | 4.4 | 2025-03-31 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The m… |
CVE-2025-2997 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipu… |
CVE-2025-31527 | Medium | 6.4 | 2025-03-31 | Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Previe… |
CVE-2025-28096 | Medium | 5.4 | 2025-03-28 | OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers. |
CVE-2025-28094 | Medium | 6.5 | 2025-03-28 | shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. |
CVE-2025-28093 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. |
CVE-2025-28092 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. |
CVE-2025-28091 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. |
CVE-2025-28090 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. |
CVE-2025-28089 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. |
CVE-2025-31076 | Medium | 4.9 | 2025-03-28 | Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects… |
CVE-2024-48944 | Medium | 6.5 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api o… |
CVE-2025-22672 | Medium | 4.9 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Reque… |
CVE-2025-30914 | Medium | 4.4 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through <= 3… |
CVE-2025-2835 | Medium | 4.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the… |
CVE-2025-27406 | High | 7.6 | 2025-03-26 | Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability presen… |