Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6271 vulnerabilities reference this CWE, most recent first.

GHSA-FMXW-FW8J-H734

Vulnerability from github – Published: 2026-08-24 12:31 – Updated: 2026-08-24 12:31
VLAI
Details

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-78269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-24T12:16:54Z",
    "severity": "MODERATE"
  },
  "details": "Contributor Server Side Request Forgery (SSRF) in Shared Files \u003c= 1.7.69 versions.",
  "id": "GHSA-fmxw-fw8j-h734",
  "modified": "2026-08-24T12:31:40Z",
  "published": "2026-08-24T12:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78269"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/shared-files/vulnerability/wordpress-shared-files-plugin-1-7-69-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FP53-QCF8-2XX2

Vulnerability from github – Published: 2026-05-08 19:09 – Updated: 2026-06-08 23:27
VLAI
Summary
Bunsink has an SSRF bypass in `validate_webhook_url`
Details

Summary

Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mismatch in URL parsing.

In some malformed URLs, Python’s standard URL parser (urllib) and the HTTP client stack (requests / urllib3) do not agree on which host is actually being targeted. That could allow a webhook URL to pass Bugsink’s outbound-host checks while the actual HTTP request is sent somewhere else.

Impact

This issue affects Bugsink’s outbound webhook integrations.

An attacker who can supply or influence a webhook URL may be able to make Bugsink send an outbound HTTP POST request to a host that should have been blocked by the webhook validation logic, including loopback, private, or otherwise non-allowlisted destinations.

The practical impact is limited:

  • this is an outbound webhook SSRF issue, not a general-purpose proxy
  • Bugsink does not follow redirects for these webhook requests
  • the request shape is constrained by how the malformed URL is normalized by the HTTP client
  • this does not give arbitrary control over every possible request path

In other words, this is a real validation bypass, but it is narrower than a full arbitrary-request primitive.

Technical Details

The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post.

For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host.

Fix

The fix has two parts:

  1. Bugsink now normalizes webhook URLs using the same HTTP client stack that will later send them, and applies validation to that normalized form.
  2. Bugsink now outright rejects raw webhook URLs containing characters outside the RFC URL character set, rather than relying on downstream normalization of malformed input.

Together, these changes remove the parser discrepancy and make webhook URL handling stricter and more predictable.

Workarounds

If users cannot upgrade immediately:

  • restrict who can configure or modify webhook URLs
  • review existing webhook configurations for malformed or unusual URLs
  • prefer tightly controlled outbound network policy at the deployment level
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "bugsink"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44502"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T19:09:04Z",
    "nvd_published_at": "2026-05-26T17:16:46Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nBugsink\u2019s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mismatch in URL parsing.\n\nIn some malformed URLs, Python\u2019s standard URL  parser (urllib) and the HTTP client stack (requests / urllib3) do not agree on which host is actually being targeted. That could allow a webhook URL to pass Bugsink\u2019s outbound-host checks while the actual HTTP request is sent somewhere else.\n\n## Impact\n\nThis issue affects Bugsink\u2019s outbound webhook integrations.\n\nAn attacker who can supply or influence a webhook URL may be able to make Bugsink send an outbound HTTP POST request to a host that should have been blocked by the webhook validation logic, including loopback,\nprivate, or otherwise non-allowlisted destinations.\n\nThe practical impact is limited:\n\n- this is an outbound webhook SSRF issue, not a general-purpose proxy\n- Bugsink does not follow redirects for these webhook requests\n- the request shape is constrained by how the malformed URL is normalized by the HTTP client\n- this does not give arbitrary control over every possible request path\n\nIn other words, this is a real validation bypass, but it is narrower than a full arbitrary-request primitive.\n\n## Technical Details\n\nThe original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post.\n\nFor malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public\nhostname during validation, while the HTTP client actually connects to a different host.\n\n## Fix\n\nThe fix has two parts:\n\n1. Bugsink now normalizes webhook URLs using the same HTTP client stack that will later send them, and applies validation to that normalized form.\n2. Bugsink now outright rejects raw webhook URLs containing characters outside the RFC URL character set, rather than relying on downstream normalization of malformed input.\n\nTogether, these changes remove the parser discrepancy and make webhook URL handling stricter and more predictable.\n\n## Workarounds\n\nIf users cannot upgrade immediately:\n\n- restrict who can configure or modify webhook URLs\n- review existing webhook configurations for malformed or unusual URLs\n- prefer tightly controlled outbound network policy at the deployment level",
  "id": "GHSA-fp53-qcf8-2xx2",
  "modified": "2026-06-08T23:27:22Z",
  "published": "2026-05-08T19:09:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bugsink/bugsink"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Bunsink has an SSRF bypass in `validate_webhook_url`"
}

GHSA-FP83-P2JC-P38W

Vulnerability from github – Published: 2026-09-28 09:30 – Updated: 2026-09-28 09:30
VLAI
Details

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-82375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-28T08:16:41Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.",
  "id": "GHSA-fp83-p2jc-p38w",
  "modified": "2026-09-28T09:30:26Z",
  "published": "2026-09-28T09:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82375"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/roller/pull/163"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/roller/pull/175"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/0p7kc0rjcpj3rf00cp96zfkfrz0ns4ny"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/25/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FPH4-WMHF-6FWF

Vulnerability from github – Published: 2026-09-02 15:42 – Updated: 2026-09-02 15:42
VLAI
Summary
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Details

Impact

fast-uri decodes a hostname's percent escapes twice in a single normalize() or resolve() call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') returns http://localhost/. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.

Patches

Fixed in fast-uri 2.4.5, 3.1.6, and 4.1.3.

Workarounds

Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve().

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.1"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.2"
            },
            {
              "fixed": "3.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-uri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75899"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-174",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T15:42:39Z",
    "nvd_published_at": "2026-08-24T10:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n`fast-uri` decodes a hostname\u0027s percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so `normalize(\u0027http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/\u0027)` returns `http://localhost/`. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.\n\n### Patches\n\nFixed in `fast-uri` 2.4.5, 3.1.6, and 4.1.3.\n\n### Workarounds\n\nReject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`.",
  "id": "GHSA-fph4-wmhf-6fwf",
  "modified": "2026-09-02T15:42:39Z",
  "published": "2026-09-02T15:42:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastify/fast-uri"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v2.4.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v3.1.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fast-uri/releases/tag/v4.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding"
}

GHSA-FPJ9-JJ78-PV6W

Vulnerability from github – Published: 2025-03-06 21:31 – Updated: 2025-03-06 21:31
VLAI
Details

A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.

Severity
6.8 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-25827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T15:15:28Z",
    "severity": "MODERATE"
  },
  "details": "A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.",
  "id": "GHSA-fpj9-jj78-pv6w",
  "modified": "2025-03-06T21:31:25Z",
  "published": "2025-03-06T21:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ka7arotto/emlog/blob/main/ssrf.md"
    },
    {
      "type": "WEB",
      "url": "https://www.emlog.net"
    },
    {
      "type": "WEB",
      "url": "http://emlogpro.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FPJQ-WFVR-WX93

Vulnerability from github – Published: 2024-06-21 00:33 – Updated: 2025-08-27 21:31
VLAI
Details

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-5746"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-20T22:15:16Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role.\u00a0This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-fpjq-wfvr-wx93",
  "modified": "2025-08-27T21:31:37Z",
  "published": "2024-06-21T00:33:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5746"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FPM8-6XJP-2HQ8

Vulnerability from github – Published: 2026-06-26 15:32 – Updated: 2026-06-26 15:32
VLAI
Details

HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.

Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Clear
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-57940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T14:17:07Z",
    "severity": "LOW"
  },
  "details": "HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -\u003e Import RSS. The server will then make a request to the attacker-controlled target.",
  "id": "GHSA-fpm8-6xjp-2hq8",
  "modified": "2026-06-26T15:32:14Z",
  "published": "2026-06-26T15:32:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danpros/htmly/blob/c8b7ed9af39a266b256759becf26dba6a59e11e6/system/admin/admin.php#L1549-L1551"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FPW6-P57H-MV5Q

Vulnerability from github – Published: 2026-04-05 06:32 – Updated: 2026-04-05 06:32
VLAI
Details

A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-5538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-05T04:16:15Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-fpw6-p57h-mv5q",
  "modified": "2026-04-05T06:32:02Z",
  "published": "2026-04-05T06:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AnalogyC0de/public_exp/issues/27"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/782203"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/355291"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/355291/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FPX8-73GF-7X73

Vulnerability from github – Published: 2026-03-05 21:43 – Updated: 2026-03-09 13:12
VLAI
Summary
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
Details

Summary

The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.

Impact

  • Cloud metadata exfiltration: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)
  • Internal service scanning: Probe internal network services not exposed to the internet
  • Data exfiltration via response logs: Full response body from internal services is stored and returned to the attacker through the webhook logs API
  • Bypass vectors: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 0.0.0.0, ::ffff: mapped addresses
Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "plane"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T21:43:15Z",
    "nvd_published_at": "2026-03-06T22:16:01Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe webhook URL validation in `plane/app/serializers/webhook.py` only checks `ip.is_loopback`, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`, `169.254.169.254`, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response \u2014 enabling SSRF with full response read-back.\n\n### Impact\n- **Cloud metadata exfiltration**: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)\n- **Internal service scanning**: Probe internal network services not exposed to the internet\n- **Data exfiltration via response logs**: Full response body from internal services is stored and returned to the attacker through the webhook logs API\n- Bypass vectors: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0`, `::ffff:` mapped addresses",
  "id": "GHSA-fpx8-73gf-7x73",
  "modified": "2026-03-09T13:12:11Z",
  "published": "2026-03-05T21:43:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30242"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/makeplane/plane"
    },
    {
      "type": "WEB",
      "url": "https://github.com/makeplane/plane/releases/tag/v1.2.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer"
}

GHSA-FPX9-9HQ8-W2XC

Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-16 01:32
VLAI
Summary
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
Details

A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "krayin/laravel-crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-38527"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T01:32:29Z",
    "nvd_published_at": "2026-04-14T16:16:43Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.",
  "id": "GHSA-fpx9-9hq8-w2xc",
  "modified": "2026-04-16T01:32:29Z",
  "published": "2026-04-14T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38527"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38527"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/krayin/laravel-crm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Webkul Krayin CRM has Server-Side Request Forgery (SSRF)"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list