CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

799

Total CVEs

163

Critical

303

High

7.2

Avg CVSS

In CISA KEV

Yearly Trend

2026

118

2025

340

2024

157

2023

2022

Top Affected Vendors

1 Microsoft 16

2 Apache 16

3 Ibm 9

4 Gitlab 7

5 Sap 6

6 Agpt 5

7 Craftcms 5

8 Maccms 5

9 Progress 4

10 Janeczku 4

All Server-Side Request Forgery (SSRF) CVEs (799)

CVE-2024-5328

9.3

This SSRF vulnerability in lunary-ai/lunary allows attackers to make unauthorized server-side requests to internal or external resources by exploiting...

Jun 6, 2024

CVE-2024-28752

9.3

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Apache CXF's Aegis DataBinding component. It allows attackers to make unautho...

Mar 15, 2024

CVE-2023-46729

9.3

This vulnerability in sentry-javascript's Next.js SDK tunnel endpoint allows attackers to send HTTP requests to arbitrary URLs and reflect responses b...

Nov 10, 2023

CVE-2025-55853

9.1

SoftVision webPDF versions before 10.0.2 contain a Server-Side Request Forgery (SSRF) vulnerability in the PDF converter function. Attackers can uploa...

Feb 19, 2026

CVE-2026-24736

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Squidex's webhook functionality that allows attackers to make the server send...

Jan 27, 2026

CVE-2026-22482

9.1

This SSRF vulnerability in wbolt.com IMGspider WordPress plugin allows attackers to make the server send unauthorized requests to internal or external...

Jan 22, 2026

CVE-2025-62741

9.1

This SSRF vulnerability in the Pool Services WordPress theme allows attackers to make unauthorized requests from the vulnerable server to internal or ...

Jan 22, 2026

CVE-2025-22726

9.1

This SSRF vulnerability in the nK Themes Helper WordPress plugin allows attackers to make the vulnerable server send unauthorized requests to internal...

Jan 8, 2026

CVE-2025-69222

9.1

LibreChat version 0.8.1-rc2 has a server-side request forgery (SSRF) vulnerability in its Actions feature that allows attackers to make unauthorized r...

Jan 7, 2026

CVE-2024-25181

9.1

CVE-2024-25181 is a critical vulnerability in givanz VvvebJs 1.7.2 that allows attackers to perform Server-Side Request Forgery (SSRF) and read arbitr...

Dec 29, 2025

CVE-2025-68600

9.1

This Server-Side Request Forgery (SSRF) vulnerability in the Link Library WordPress plugin allows attackers to make unauthorized requests from the vul...

Dec 24, 2025

CVE-2025-68500

9.1

This SSRF vulnerability in the bdthemes Prime Slider WordPress plugin allows attackers to make unauthorized requests from the vulnerable server to int...

Dec 24, 2025

CVE-2025-67623

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in the 6Storage Rentals WordPress plugin. Attackers can exploit this to make the...

Dec 24, 2025

CVE-2025-66844

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Grav CMS versions before 1.7.49.5. Attackers can exploit Twig template proces...

Dec 15, 2025

CVE-2025-13872

9.1

This vulnerability allows attackers to perform blind Server-Side Request Forgery (SSRF) attacks through the survey-import feature of ObjectPlanet Opin...

Dec 2, 2025

CVE-2025-65836

9.1

PublicCMS V5.202506.b contains a Server-Side Request Forgery (SSRF) vulnerability in the chat interface of SimpleAiAdminController. This allows attack...

Dec 1, 2025

CVE-2025-64522

9.1

Soft Serve versions before 0.11.1 have a server-side request forgery (SSRF) vulnerability where repository administrators can create webhooks that tar...

Nov 10, 2025

CVE-2025-34282

9.1

This SSRF vulnerability in ThingsBoard allows attackers to upload malicious SVG files that trigger outbound requests from the server. Attackers can ex...

Oct 17, 2025

CVE-2025-44594

9.1

This SSRF vulnerability in halo allows attackers to make the server send arbitrary HTTP requests to internal systems. Attackers can potentially access...

Sep 9, 2025

CVE-2025-27217

9.1

This Server-Side Request Forgery (SSRF) vulnerability in the UISP Application allows authenticated attackers to make unauthorized requests to internal...

Aug 21, 2025

CVE-2025-50251

9.1

This SSRF vulnerability in makeplane plane 0.23.1 allows attackers to make unauthorized requests from the server via the password recovery feature. At...

Aug 13, 2025

CVE-2025-52362

9.1

This SSRF vulnerability in PHProxy allows attackers to bypass URL validation and make unauthorized requests to internal systems. Remote unauthenticate...

Jul 21, 2025

CVE-2025-6087

9.1

A Server-Side Request Forgery (SSRF) vulnerability in the @opennextjs/cloudflare package allows unauthenticated attackers to proxy arbitrary remote co...

Jun 16, 2025

CVE-2024-6584

9.1

This vulnerability in WordPress allows administrators to make arbitrary GET requests to any URL through the 'wp_ajax_boost_proxy_ig' action. It enable...

May 15, 2025

CVE-2025-47733

9.1

This Server-Side Request Forgery (SSRF) vulnerability in Microsoft Power Apps allows attackers to make unauthorized requests from the server to intern...

May 8, 2025

CVE-2025-28197

9.1

Crawl4AI versions up to 0.4.247 contain a Server-Side Request Forgery (SSRF) vulnerability in the async_dispatcher.py component. This allows attackers...

Apr 18, 2025

CVE-2025-28091

9.1

This SSRF vulnerability in maccms10 allows attackers to make the server send arbitrary HTTP requests to internal or external systems via the 'Add Arti...

Mar 28, 2025

CVE-2025-28089

9.1

This SSRF vulnerability in maccms10 allows attackers to make the server send unauthorized requests to internal systems via the Scheduled Task function...

Mar 28, 2025

CVE-2024-45479

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in the Edit Service Page of Apache Ranger UI. Attackers can exploit this to make...

Jan 21, 2025

CVE-2024-54819

EPSS 43.8% 9.1

CVE-2024-54819 is a Server-Side Request Forgery (SSRF) vulnerability in I, Librarian versions up to 5.11.1 that allows attackers to make the server se...

Jan 7, 2025

CVE-2024-47578

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Adobe Document Service that allows authenticated administrators to send craft...

Dec 10, 2024

CVE-2024-50811

9.1

This SSRF vulnerability in Hopetree iZone LTS allows attackers to make the server send unauthorized requests to internal systems. It affects systems r...

Nov 8, 2024

CVE-2024-29736

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Apache CXF's WADL service description. It allows attackers to make unauthoriz...

Jul 19, 2024

CVE-2024-36675

9.1

LyLme_spage v1.9.5 contains a Server-Side Request Forgery (SSRF) vulnerability in the get_head function that allows attackers to make arbitrary HTTP r...

Jun 4, 2024

CVE-2024-4399

9.1

This vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks by exploiting improper input validation in a...

May 23, 2024

CVE-2024-25738

9.1

A Server-Side Request Forgery (SSRF) vulnerability in VuFind's /Upgrade/FixConfig route allows attackers to overwrite local configuration files. This ...

May 22, 2024

CVE-2024-31461

9.1

Plane project management tool versions before 0.17-dev have a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to make arbitrary...

Apr 10, 2024

CVE-2024-25294

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in REBUILD v3.5 that allows remote attackers to make unauthorized requests from ...

Mar 20, 2024

CVE-2024-22203

9.1

This vulnerability allows attackers to perform server-side request forgery (SSRF) in Whoogle Search, enabling them to make unauthorized GET requests t...

Jan 23, 2024

CVE-2024-22205

9.1

This vulnerability in Whoogle Search allows attackers to perform server-side request forgery (SSRF) by exploiting unsanitized user input in the 'windo...

Jan 23, 2024

CVE-2023-50731

9.1

This is a path injection vulnerability in MindsDB that allows attackers to write arbitrary files to the server filesystem and delete zip/tar.gz files....

Dec 22, 2023

CVE-2023-48023

9.1

CVE-2023-48023 is a Server-Side Request Forgery (SSRF) vulnerability in the /log_proxy endpoint of Anyscale Ray versions 2.6.3 and 2.8.0. This allows ...

Nov 28, 2023

CVE-2022-42183

9.1

CVE-2022-42183 is a Server-Side Request Forgery (SSRF) vulnerability in Precisely Spectrum Spatial Analyst 20.01 that allows attackers to make unautho...

Jul 31, 2023

CVE-2022-25800

9.1

This vulnerability allows Server-Side Request Forgery (SSRF) attacks through the whois lookup tool in Best Practical RT for Incident Response (RTIR). ...

Jul 14, 2022

CVE-2022-31386

9.1

This Server-Side Request Forgery (SSRF) vulnerability in nbnbk CMS 3 allows attackers to inject arbitrary URLs into the URL parameter of the getFileBi...

Jun 9, 2022

CVE-2022-31393

9.1

Jizhicms v2.2.5 contains a Server-Side Request Forgery (SSRF) vulnerability in the PluginsController.php Index function. This allows attackers to make...

Jun 9, 2022

CVE-2022-31830

9.1

CVE-2022-31830 is a Server-Side Request Forgery (SSRF) vulnerability in Kity Minder v1.3.5 that allows attackers to make arbitrary HTTP requests from ...

Jun 9, 2022

CVE-2022-1379

9.1

CVE-2022-1379 is a URL restriction bypass vulnerability in PlantUML that allows attackers to bypass security profile restrictions and perform server-s...

May 14, 2022

CVE-2022-26499

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Asterisk VoIP software when using STIR/SHAKEN caller ID authentication. Attac...

Apr 15, 2022

CVE-2022-0990

9.1

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Calibre-Web, an open-source web application for managing eBook collections. T...

Apr 4, 2022

← Previous Page 3 of 16 Next →

About Server-Side Request Forgery (SSRF) (CWE-918)

Our database tracks 799 CVEs classified as CWE-918, with 163 rated critical and 303 rated high severity. The average CVSS score for Server-Side Request Forgery (SSRF) vulnerabilities is 7.2.

External reference: View CWE-918 on MITRE CWE →

Monitor Server-Side Request Forgery (SSRF) Vulnerabilities

Get alerted when new Server-Side Request Forgery (SSRF) CVEs affect your infrastructure.

Start Monitoring Free