CWE-918 · Server-Side Request Forgery (SSRF) (page 21)
Page 21 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5021 | Critical | 9.3 | 2024-06-19 | The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1… |
CVE-2024-4404 | High | 8.5 | 2024-06-14 | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. Th… |
CVE-2024-37164 | High | 7.1 | 2024-06-13 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs… |
CVE-2024-34111 | Medium | 6.5 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36414 | High | 7.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors f… |
CVE-2024-4354 | Medium | 6.4 | 2024-06-07 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via… |
CVE-2024-5328 | Critical | 9.3 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xm… |
CVE-2024-5186 | High | 7.2 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers… |
CVE-2024-4851 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal netwo… |
CVE-2024-3149 | High | 8.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manag… |
CVE-2024-3095 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability ar… |
CVE-2024-5482 | Critical | 9.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version… |
CVE-2024-4325 | High | 8.6 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save… |
CVE-2024-3152 | High | 8.8 | 2024-06-06 | mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulne… |
CVE-2024-4177 | High | 8.1 | 2024-06-06 | A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This… |
CVE-2024-20404 | High | 7.2 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected… |
CVE-2024-5526 | High | 7.7 | 2024-06-05 | Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tai… |
CVE-2024-4084 | High | 7.5 | 2024-06-05 | A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix in… |
CVE-2024-36675 | Critical | 9.1 | 2024-06-04 | LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. |
CVE-2024-4219 | Medium | 4.8 | 2024-06-04 | Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forg… |
CVE-2024-35635 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9. |
CVE-2024-35633 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through… |
CVE-2024-35637 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6. |
CVE-2023-7073 | Medium | 6.4 | 2024-05-31 | The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via… |
CVE-2024-4469 | High | 7.5 | 2024-05-31 | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks… |
CVE-2024-36427 | High | 8.1 | 2024-05-29 | The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to se… |
CVE-2024-29415 | High | 8.1 | 2024-05-27 | The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0… |
CVE-2024-4399 | Critical | 9.1 | 2024-05-23 | The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack |
CVE-2024-1855 | Medium | 5.3 | 2024-05-23 | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Reques… |
CVE-2024-25738 | Critical | 9.1 | 2024-05-22 | A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remo… |
CVE-2024-5031 | High | 8.5 | 2024-05-22 | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file'… |
CVE-2024-30420 | Medium | 4.4 | 2024-05-22 | Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver… |
CVE-2024-4789 | Medium | 6.4 | 2024-05-17 | Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() functio… |
CVE-2023-46784 | High | 8.2 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services… |
CVE-2024-3970 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory… |
CVE-2024-3485 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. |
CVE-2024-4894 | Medium | 5.3 | 2024-05-15 | ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Sid… |
CVE-2024-4562 | Medium | 5.4 | 2024-05-14 | In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. D… |
CVE-2024-4561 | Medium | 4.2 | 2024-05-14 | In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send ar… |
CVE-2024-0862 | Medium | 5.0 | 2024-05-14 | The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user t… |
CVE-2024-33864 | Medium | 5.9 | 2024-05-14 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file i… |
CVE-2024-35172 | Medium | 4.4 | 2024-05-14 | Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Ima… |
CVE-2024-34351 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in… |
CVE-2024-33250 | High | 7.2 | 2024-05-14 | An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to execute arbitrary code… |
CVE-2024-32964 | Critical | 9.0 | 2024-05-14 | Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an una… |
CVE-2024-1467 | Medium | 4.3 | 2024-05-14 | The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to… |
CVE-2024-33857 | Critical | 9.6 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the sy… |
CVE-2024-33117 | Medium | 5.3 | 2024-05-06 | crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController. |
CVE-2024-34453 | Medium | 4.3 | 2024-05-03 | TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php). |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2024-3047 | High | 7.2 | 2024-05-02 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via… |
CVE-2023-46295 | Critical | 9.8 | 2024-05-01 | An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sendi… |
CVE-2024-23336 | Medium | 5.0 | 2024-05-01 | MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Serv… |
CVE-2024-33832 | Medium | 6.3 | 2024-04-30 | OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info. |
CVE-2024-2663 | High | 8.3 | 2024-04-30 | The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $_GET['image']… |
CVE-2024-0216 | Medium | 6.4 | 2024-04-30 | The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. Th… |
CVE-2024-33590 | Medium | 5.0 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documen… |
CVE-2024-33634 | Medium | 5.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a thro… |
CVE-2024-33629 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post… |
CVE-2024-33627 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a thr… |
CVE-2024-33592 | Medium | 5.4 | 2024-04-25 | Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. |
CVE-2024-32812 | Medium | 5.4 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11. |
CVE-2024-32803 | Medium | 6.4 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.4… |
CVE-2024-32775 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9. |
CVE-2024-32718 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Webangon The Pack Elementor.This issue affects The Pack Elementor addons: from n/a through 2.0.8.2. |
CVE-2024-32955 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5… |
CVE-2024-32819 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Culqi.This issue affects Culqi: from n/a through 3.0.14. |
CVE-2023-7253 | Medium | 6.1 | 2024-04-24 | The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem i… |
CVE-2024-32407 | High | 8.8 | 2024-04-22 | An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature. |
CVE-2024-27347 | Medium | 5.3 | 2024-04-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are rec… |
CVE-2024-31993 | Medium | 6.2 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however… |
CVE-2024-31991 | Medium | 4.1 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-29029 | Medium | 6.1 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users… |
CVE-2024-29030 | Medium | 5.8 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users t… |
CVE-2024-29028 | Medium | 5.8 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated use… |
CVE-2024-2796 | Critical | 9.3 | 2024-04-18 | A server-side request forgery (SSRF) was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson. |
CVE-2024-29021 | Critical | 9.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Re… |
CVE-2024-31229 | Medium | 5.5 | 2024-04-18 | Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3. |
CVE-2024-29035 | Medium | 4.1 | 2024-04-17 | Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vu… |
CVE-2023-6805 | Medium | 6.4 | 2024-04-17 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Reques… |
CVE-2024-22329 | Medium | 4.3 | 2024-04-17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery… |
CVE-2024-30256 | Medium | 6.4 | 2024-04-16 | Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.1… |
CVE-2024-22262 | High | 8.1 | 2024-04-16 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-32430 | Medium | 4.4 | 2024-04-15 | Server-Side Request Forgery (SSRF) vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14. |
CVE-2024-32454 | Medium | 4.4 | 2024-04-15 | Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointmen… |
CVE-2024-31461 | Critical | 9.1 | 2024-04-10 | Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an at… |
CVE-2024-3448 | Medium | 5.0 | 2024-04-10 | Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailabilit… |
CVE-2023-40148 | Medium | 6.5 | 2024-04-10 | Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forge… |
CVE-2024-2343 | Medium | 6.4 | 2024-04-09 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2024-1812 | High | 7.2 | 2024-04-09 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. T… |
CVE-2023-6964 | High | 8.5 | 2024-04-09 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc… |
CVE-2024-1233 | High | 7.3 | 2024-04-09 | A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting… |
CVE-2024-27898 | Medium | 5.3 | 2024-04-09 | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting inter… |
CVE-2024-31288 | High | 7.2 | 2024-04-07 | Server-Side Request Forgery (SSRF) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize.This issue affects RapidLoad Power-Up for Autoptimize: from n/… |
CVE-2024-27620 | High | 7.5 | 2024-04-06 | An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API. |
CVE-2024-31215 | Medium | 6.3 | 2024-04-04 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase… |
CVE-2024-29007 | High | 7.3 | 2024-04-04 | The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTT… |
CVE-2024-20332 | Medium | 5.5 | 2024-04-03 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a server… |
CVE-2021-27312 | Critical | 9.4 | 2024-04-03 | Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via mod… |