CWE-918 · Server-Side Request Forgery (SSRF) (page 18)
Page 18 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1912 | High | 7.6 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions u… |
CVE-2024-13411 | Medium | 6.4 | 2025-03-26 | The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() f… |
CVE-2025-2109 | Medium | 5.8 | 2025-03-25 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includi… |
CVE-2024-10207 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the… | |
CVE-2024-10206 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force th… | |
CVE-2025-2691 | High | 8.2 | 2025-03-23 | Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a lo… |
CVE-2025-1970 | High | 7.6 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the… |
CVE-2024-13856 | Medium | 6.4 | 2025-03-22 | The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ… |
CVE-2024-48590 | Critical | 9.8 | 2025-03-20 | Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an attacker to escalate privileges and ob… |
CVE-2025-27888 | Medium | 5.4 | 2025-03-20 | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), U… |
CVE-2024-13923 | High | 7.6 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 v… |
CVE-2025-0454 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnera… |
CVE-2025-0188 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to const… |
CVE-2025-0184 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section… |
CVE-2024-9309 | Critical | 9.3 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava ve… |
CVE-2024-8955 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of… |
CVE-2024-8952 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSIT… |
CVE-2024-8099 | High | 8.3 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit th… |
CVE-2024-12882 | High | 7.5 | 2025-03-20 | comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combini… |
CVE-2024-12779 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and… |
CVE-2024-12775 | Medium | 6.5 | 2025-03-20 | langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the… |
CVE-2024-12766 | High | 7.5 | 2025-03-20 | parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can ex… |
CVE-2024-12450 | Critical | 9.8 | 2025-03-20 | In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parame… |
CVE-2024-12392 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download pap… |
CVE-2024-12376 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vul… |
CVE-2024-12068 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to… |
CVE-2024-11822 | High | 7.5 | 2025-03-20 | langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoin… |
CVE-2024-11603 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where… |
CVE-2024-11449 | High | 7.5 | 2025-03-20 | A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can… |
CVE-2024-11031 | High | 7.5 | 2025-03-20 | In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() A… |
CVE-2024-11030 | High | 7.5 | 2025-03-20 | GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_util… |
CVE-2024-10457 | Medium | 6.5 | 2025-03-20 | Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integrat… |
CVE-2025-27777 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) in `model_download.py` (line 195 in 3.2.7). Th… |
CVE-2025-27776 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 24… |
CVE-2025-27775 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 14… |
CVE-2025-27774 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 15… |
CVE-2024-49822 | Medium | 4.1 | 2025-03-18 | IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reque… |
CVE-2025-22474 | Medium | 6.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A high privil… |
CVE-2024-13838 | Medium | 5.5 | 2025-03-12 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in a… |
CVE-2025-2192 | Medium | 4.3 | 2025-03-11 | A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the… |
CVE-2025-27430 | Low | 3.5 | 2025-03-11 | Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted inf… |
CVE-2025-22603 | High | 8.1 | 2025-03-10 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior… |
CVE-2025-2116 | Medium | 4.3 | 2025-03-09 | A vulnerability has been found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as problematic. Affect… |
CVE-2024-13924 | Medium | 5.3 | 2025-03-08 | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'h… |
CVE-2024-53696 | Medium | 4.9 | 2025-03-07 | A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-27152 | Medium | 5.3 | 2025-03-07 | axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even… |
CVE-2024-13857 | Medium | 5.5 | 2025-03-07 | The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10… |
CVE-2024-13904 | Medium | 5.3 | 2025-03-07 | The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.6 via the 'ho… |
CVE-2025-27600 | Medium | 6.5 | 2025-03-06 | FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an… |
CVE-2025-27655 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009. |
CVE-2025-27652 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015. |
CVE-2025-27651 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014. |
CVE-2025-27501 | High | 8.6 | 2025-03-03 | OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form o… |
CVE-2025-25303 | | 2025-03-03 | The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extension is vulnerable to… | |
CVE-2025-25301 | High | 7.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetch… |
CVE-2025-1849 | Medium | 6.3 | 2025-03-03 | A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /import_data… |
CVE-2025-1848 | Medium | 6.3 | 2025-03-03 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /import_data_check. The manipulati… |
CVE-2025-1833 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/… |
CVE-2025-1799 | Medium | 6.3 | 2025-03-01 | A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/ad… |
CVE-2024-13697 | Medium | 4.8 | 2025-03-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery… |
CVE-2025-1662 | Medium | 6.4 | 2025-02-28 | The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploade… |
CVE-2025-22952 | Critical | 9.8 | 2025-02-27 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perfo… |
CVE-2025-25760 | High | 7.5 | 2025-02-27 | A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET… |
CVE-2024-13907 | Medium | 4.9 | 2025-02-27 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… |
CVE-2024-13905 | Medium | 5.3 | 2025-02-27 | The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file… |
CVE-2025-25827 | Medium | 6.8 | 2025-02-26 | A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted UR… |
CVE-2025-25785 | Critical | 9.1 | 2025-02-26 | JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-13695 | Medium | 6.4 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This… |
CVE-2025-1548 | Low | 3.5 | 2025-02-21 | A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archi… |
CVE-2025-1043 | Medium | 6.4 | 2025-02-20 | The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a… |
CVE-2024-37359 | High | 8.6 | 2025-02-19 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that th… |
CVE-2025-27090 | Medium | 5.3 | 2025-02-19 | Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The r… |
CVE-2025-1447 | Medium | 4.3 | 2025-02-19 | A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgpro… |
CVE-2024-13741 | Medium | 5.4 | 2025-02-18 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and in… |
CVE-2025-20075 | High | 7.2 | 2025-02-18 | Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests cou… |
CVE-2024-13879 | Medium | 5.5 | 2025-02-17 | The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the… |
CVE-2024-13834 | Medium | 5.4 | 2025-02-15 | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Reque… |
CVE-2025-25297 | High | 8.6 | 2025-02-14 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forger… |
CVE-2024-9870 | Medium | 4.3 | 2025-02-12 | An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 al… |
CVE-2025-26494 | High | 7.7 | 2025-02-11 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 throu… |
CVE-2025-22399 | High | 7.9 | 2025-02-11 | Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. An unauthenticated attacker with local access could potentially… |
CVE-2024-52606 | Low | 3.5 | 2025-02-11 | SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicio… |
CVE-2025-1211 | Medium | 6.5 | 2025-02-11 | Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and h… |
CVE-2025-25194 | Medium | 4.0 | 2025-02-10 | Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for… |
CVE-2025-21177 | High | 8.7 | 2025-02-06 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network. |
CVE-2024-56471 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2024-56470 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-25065 | Medium | 5.3 | 2025-02-03 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized re… |
CVE-2025-22701 | Medium | 5.4 | 2025-02-03 | Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affec… |
CVE-2024-44055 | Medium | 5.4 | 2025-01-31 | Server-Side Request Forgery (SSRF) vulnerability in brandexponents Oshine Modules oshine-modules.This issue affects Oshine Modules: from n/a through < 3.3.8. |
CVE-2023-6195 | Low | 2.6 | 2025-01-31 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2025-24354 | Medium | 5.3 | 2025-01-27 | imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRE… |
CVE-2024-10705 | Medium | 5.4 | 2025-01-26 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the… |
CVE-2024-13450 | Low | 3.8 | 2025-01-25 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2025-24703 | Medium | 4.4 | 2025-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request… |
CVE-2025-24701 | Medium | 4.4 | 2025-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a… |
CVE-2025-24695 | Medium | 4.4 | 2025-01-24 | Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Exte… |
CVE-2024-11913 | Medium | 5.4 | 2025-01-24 | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 v… |
CVE-2024-43710 | Medium | 4.3 | 2025-01-23 | A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints… |