VYPR

CWE-918

Server-Side Request Forgery (SSRF)

BaseIncomplete

Description

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-664

CVEs mapped to this weakness (3,682)

page 84 of 185
  • CVE-2025-11361MedOct 18, 2025
    WordPress
    Essential Blocks
    risk 0.42cvss 6.4epss 0.00

    The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated…

  • CVE-2025-60540MedOct 14, 2025
    Karakeep App
    Karakeep
    risk 0.42cvss 6.5epss 0.00

    karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).

  • CVE-2025-61784HigOct 7, 2025
    Hiyouga
    Llama Factory
    risk 0.42cvss 7.6epss 0.00

    LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can…

  • CVE-2025-57305MedOct 2, 2025
    VitaraCharts
    VitaraCharts
    risk 0.42cvss 6.5epss 0.00

    VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.

  • CVE-2025-58962MedSep 22, 2025
    Publitio
    Publitio
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.

  • CVE-2025-58011MedSep 22, 2025
    WordPress
    Content Mask
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.

  • CVE-2025-57055MedSep 17, 2025
    WonderCMS
    Wondercms
    risk 0.42cvss 6.5epss 0.00

    WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without…

  • CVE-2025-7843MedSep 10, 2025
    WordPress
    Auto Save Remote Images Drafts
    risk 0.42cvss 6.4epss 0.00

    The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to…

  • CVE-2025-54249MedSep 9, 2025
    Adobe Inc.
    Experience Manager
    risk 0.42cvss 6.5epss 0.02

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass…

  • CVE-2025-47437MedSep 9, 2025
    WordPress
    Litespeed Cache
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.

  • CVE-2025-53250MedAug 28, 2025
    Chartbeat
    Chartbeat
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat chartbeat allows Server Side Request Forgery.This issue affects Chartbeat: from n/a through <= 2.0.7.

  • CVE-2025-43747MedAug 21, 2025
    Liferay
    DXP
    risk 0.42cvss 6.5epss 0.00

    A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this…

  • CVE-2025-28987MedAug 14, 2025
    WordPress
    Pressforward
    risk 0.42cvss 6.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward: from n/a through <= 5.9.5.

  • CVE-2025-51058MedAug 6, 2025
    Bottinelli Informatical
    Vedo Suite
    risk 0.42cvss 6.5epss 0.00

    Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter.

  • CVE-2024-55399MedAug 6, 2025
    4C Strategies
    Exonaut
    risk 0.42cvss 6.5epss 0.00

    4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).

  • CVE-2025-50234MedAug 6, 2025
    MCCMS
    MCCMS
    risk 0.42cvss 6.5epss 0.00

    MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key…

  • CVE-2025-45939MedJul 25, 2025
    Apwide
    Golive
    risk 0.42cvss 6.5epss 0.00

    Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.

  • CVE-2025-52163MedJul 18, 2025
    Agorum Software GmbH
    core open
    risk 0.42cvss 6.5epss 0.00

    A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data…

  • CVE-2024-43394HigJul 10, 2025
    Apache
    HTTP Server
    risk 0.42cvss 7.5epss 0.01

    Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. …

  • CVE-2024-43204HigJul 10, 2025
    Apache
    HTTP Server
    risk 0.42cvss 7.5epss 0.01

    SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value…