CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-M29G-62VQ-8HCX
Vulnerability from github – Published: 2023-06-30 18:31 – Updated: 2024-04-04 05:18Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
{
"affected": [],
"aliases": [
"CVE-2023-35175"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-30T16:15:09Z",
"severity": "CRITICAL"
},
"details": "Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.",
"id": "GHSA-m29g-62vq-8hcx",
"modified": "2024-04-04T05:18:52Z",
"published": "2023-06-30T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35175"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_8651322-8651446-16/hpsbpi03851"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M2HF-R4MH-RRQ8
Vulnerability from github – Published: 2026-08-10 00:31 – Updated: 2026-08-11 03:31A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-19373"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-09T23:16:36Z",
"severity": "LOW"
},
"details": "A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-m2hf-r4mh-rrq8",
"modified": "2026-08-11T03:31:53Z",
"published": "2026-08-10T00:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19373"
},
{
"type": "WEB",
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3"
},
{
"type": "WEB",
"url": "https://github.com/adenot/mcp-google-search/issues/11"
},
{
"type": "WEB",
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-19373"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/866271"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387257"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387257/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M2J8-J5HH-QC3W
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-92380"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:19:01Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-m2j8-j5hh-qc3w",
"modified": "2026-09-16T15:31:14Z",
"published": "2026-09-16T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92380"
},
{
"type": "WEB",
"url": "https://github.com/wuzhicms/wuzhicms/issues/221"
},
{
"type": "WEB",
"url": "https://github.com/wuzhicms/wuzhicms"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-92380"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/935194"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/405512"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/405512/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M2Q4-QGHH-P9CQ
Vulnerability from github – Published: 2021-05-21 19:21 – Updated: 2021-05-20 22:39The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yoast-seo-for-typo3/yoast_seo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-31779"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-20T22:39:55Z",
"nvd_published_at": "2021-04-28T07:15:00Z",
"severity": "MODERATE"
},
"details": "The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.",
"id": "GHSA-m2q4-qghh-p9cq",
"modified": "2021-05-20T22:39:55Z",
"published": "2021-05-21T19:21:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31779"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2021-006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in yoast_seo"
}
GHSA-M2V2-9GXP-2R53
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/proxy REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter {"url":"http://steal.target"}. Existing security mechanisms such as forbid_remote_access(lollmsElfServer), lollmsElfServer.config.headless_server_mode, and check_access(lollmsElfServer, request.client_id) do not protect against this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-12766"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:30Z",
"severity": "HIGH"
},
"details": "parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server\u0027s credentials to access unauthorized web resources by specifying the JSON parameter `{\"url\":\"http://steal.target\"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)` do not protect against this vulnerability.",
"id": "GHSA-m2v2-9gxp-2r53",
"modified": "2025-03-20T12:32:43Z",
"published": "2025-03-20T12:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12766"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M32R-7FMP-XPVF
Vulnerability from github – Published: 2025-09-09 21:30 – Updated: 2025-09-10 15:31halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
{
"affected": [],
"aliases": [
"CVE-2025-44594"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T20:15:40Z",
"severity": "CRITICAL"
},
"details": "halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.",
"id": "GHSA-m32r-7fmp-xpvf",
"modified": "2025-09-10T15:31:16Z",
"published": "2025-09-09T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44594"
},
{
"type": "WEB",
"url": "https://meadow-horn-b94.notion.site/halo-ssrf-14c42bd5b11880c09936df07f58f5bed?pvs=74"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M337-M764-PRG6
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
{
"affected": [],
"aliases": [
"CVE-2021-31910"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-11T13:15:00Z",
"severity": "HIGH"
},
"details": "In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.",
"id": "GHSA-m337-m764-prg6",
"modified": "2022-05-24T19:02:07Z",
"published": "2022-05-24T19:02:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31910"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M37J-2VR4-QQ8W
Vulnerability from github – Published: 2022-02-26 00:00 – Updated: 2022-03-17 00:05JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).
{
"affected": [],
"aliases": [
"CVE-2022-25260"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-25T20:15:00Z",
"severity": "CRITICAL"
},
"details": "JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).",
"id": "GHSA-m37j-2vr4-qq8w",
"modified": "2022-03-17T00:05:04Z",
"published": "2022-02-26T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25260"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M38C-5P3M-P7GM
Vulnerability from github – Published: 2026-02-14 09:31 – Updated: 2026-02-14 09:31The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2026-0745"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-14T07:16:09Z",
"severity": "HIGH"
},
"details": "The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the \u0027download_language()\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-m38c-5p3m-p7gm",
"modified": "2026-02-14T09:31:33Z",
"published": "2026-02-14T09:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0745"
},
{
"type": "WEB",
"url": "https://downloads.wordpress.org/plugin/user-language-switch.zip"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/user-language-switch/tags/1.6.10/uls-options.php#L451"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/user-language-switch/trunk/uls-options.php#L451"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/user-language-switch"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a338-ccf1a6eb226c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M39W-XF3H-V4H2
Vulnerability from github – Published: 2026-08-06 03:31 – Updated: 2026-08-06 03:31A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-18973"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T01:16:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-m39w-xf3h-v4h2",
"modified": "2026-08-06T03:31:13Z",
"published": "2026-08-06T03:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18973"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-18973"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862456"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862458"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862570"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862608"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/386262"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/386262/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.