CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,714 vulnerabilities with CWE-918
CVE-2025-23082
HIGH
Veeam Backup for Microsoft Azure 7.0.0.467-7.1.0.59 - Unauthenticated Server-Side Request Forgery
CVSS 7.2
CVE-2025-21385
HIGH
Microsoft Purview - Server-Side Request Forgery
CVSS 8.8
CVE-2025-22215
MEDIUM
VMware Aria Automation < 8.18.1 patch 1 - Server-Side Request Forgery
CVSS 4.3
CVE-2024-50337
MEDIUM
Chamilo LMS < 1.11.28 - Unauthenticated Server-Side Request Forgery via OpenId Function
CVSS 5.3
CVE-2024-25181
CRITICAL
givanz VvvebJs 1.7.2 - SSRF, File Reading
CVSS 9.1
CVE-2024-46413
MEDIUM
rebuild < 3.7.7 - Server-Side Request Forgery via Type Parameter
CVSS 5.1
CVE-2024-39954
MEDIUM
Apache EventMesh < 1.12.0 - Server-Side Request Forgery via WebhookUtil
CVSS 6.3
CVE-2024-55399
MEDIUM
4cstrategies exonaut < 21.6.2.1-1 - Server-Side Request Forgery
CVSS 6.5
CVE-2024-9408
CRITICAL
Eclipse GlassFish >= 6.2.5 - Server-Side Request Forgery
CVSS 9.8
CVE-2024-43394
HIGH
Apache HTTP Server 2.4.0-2.4.63 - Server-Side Request Forgery via mod_rewrite or Apache Expressions
CVSS 7.5
CVE-2024-43204
HIGH
Apache HTTP Server 2.4.0-2.4.63 - Server-Side Request Forgery via mod_proxy
CVSS 7.5
CVE-2024-51981
MEDIUM
Brother Printer WS-Eventing - Blind Server-Side Request Forgery
CVSS 5.3
CVE-2024-51980
MEDIUM
Brother Printers WS-Addressing ReplyTo - Limited Server-Side Request Forgery Port Scanning
CVSS 5.3
CVE-2024-40625
MEDIUM
GeoServer < 2.26.0 - Server-Side Request Forgery via Coverage REST API
CVSS 5.5
CVE-2024-34711
CRITICAL
GeoServer < 2.25.0 - XML External Entity Injection via URI Validation Bypass
CVSS 9.3
CVE-2024-29198
HIGH
GeoServer Demo Request Endpoint - Server Side Request Forgery
CVSS 7.5
CVE-2024-7073
MEDIUM
WSO2 Identity Server and Open Banking IAM/KM - Unauthenticated Server-Side Request Forgery via SOAP Admin Services
CVSS 6.5
CVE-2024-52588
MEDIUM
Strapi < 4.25.2 - Server-Side Request Forgery via Webhooks URL Field
CVSS 4.9
CVE-2024-13957
HIGH
ABB ASPECT, NEXUS, and MATRIX <=3.x - Admin Server-Side Request Forgery
CVSS 7.6
CVE-2024-6584
CRITICAL
WordPress Jetpack Boost 3.4.7 - Admin Server-Side Request Forgery
CVSS 9.1
CVE-2024-13940
MEDIUM
Ninja Forms Webhooks <= 3.0.7 - Authenticated Server-Side Request Forgery via Form Webhook Functionality
CVSS 5.5
CVE-2024-55910
MEDIUM
IBM Concert 1.0.0-1.0.5 - Authenticated Server-Side Request Forgery
CVSS 6.5
CVE-2024-48907
HIGH
Sematell ReplyOne 7.4.3.0 - Server-Side Request Forgery via Application Server API
CVSS 7.5
CVE-2024-13845
MEDIUM
Gravity Forms WebHooks <= 1.6.0 - Authenticated Server-Side Request Forgery via process_feed Method
CVSS 5.5
CVE-2024-56736
MEDIUM
Apache HertzBeat < 1.7.0 - Server-Side Request Forgery
CVSS 6.5
Details
Vulnerabilities
2,714