Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4861 vulnerabilities reference this CWE, most recent first.

GHSA-4HJQ-9XXM-GCG6

Vulnerability from github – Published: 2022-05-14 01:51 – Updated: 2022-05-14 01:51
VLAI
Details

An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.

Severity
8.6 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-18867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-31T05:29:00Z",
    "severity": "HIGH"
  },
  "details": "An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.",
  "id": "GHSA-4hjq-9xxm-gcg6",
  "modified": "2022-05-14T01:51:59Z",
  "published": "2022-05-14T01:51:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18867"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trippo/ResponsiveFilemanager/issues/506"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4HW6-J957-CHCW

Vulnerability from github – Published: 2025-11-19 21:31 – Updated: 2025-11-19 21:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-13147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-19T21:15:48Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.",
  "id": "GHSA-4hw6-j957-chcw",
  "modified": "2025-11-19T21:31:24Z",
  "published": "2025-11-19T21:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13147"
    },
    {
      "type": "WEB",
      "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2024/page/Fixed-Issues-in-2024.1.8.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2025/page/Fixed-Issues-in-2025.0.4.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2025_1/page/Fixed-Issues-in-2025.1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4HX9-P925-QCV7

Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2024-04-24 17:45
VLAI
Summary
phpBB Server side request forgery (SSRF)
Details

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

Severity
5.8 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpbb/phpbb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-11767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T17:45:12Z",
    "nvd_published_at": "2019-05-05T06:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.",
  "id": "GHSA-4hx9-p925-qcv7",
  "modified": "2024-04-24T17:45:12Z",
  "published": "2022-05-24T16:45:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11767"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phpbb/phpbb-app"
    },
    {
      "type": "WEB",
      "url": "https://www.phpbb.com/community/viewtopic.php?f=14\u0026t=2509941"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpBB Server side request forgery (SSRF)"
}

GHSA-4J42-WQ8Q-C389

Vulnerability from github – Published: 2022-05-14 01:09 – Updated: 2022-05-14 01:09
VLAI
Details

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.

Severity
10.0 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-9174"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-17T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.",
  "id": "GHSA-4j42-wq8q-c389",
  "modified": "2022-05-14T01:09:25Z",
  "published": "2022-05-14T01:09:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9174"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/blog/categories/releases"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/55468"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4JC5-G844-4X33

Vulnerability from github – Published: 2026-07-30 14:46 – Updated: 2026-07-30 14:46
VLAI
Summary
linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
Details

Summary

lib.url.fetch() follows HTTP redirects (follow_redirects=True). httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish's X-Auth-Token, an API key, ...) was still sent to the redirect target. A malicious or redirect-capable server can therefore answer an authenticated request with a 3xx to an attacker-chosen host and receive the credential (server-side request forgery + token disclosure). The pre-httpx urllib implementation was worse: it forwarded every header, including Authorization, across cross-host redirects.

Impact

Any plugin that authenticates to a host with a non-standard auth header and follows that host's redirects can be coerced into sending the credential, and an authenticated request, to another host the monitoring server can reach. The concrete case is the Redfish checks (X-Auth-Token), but the flaw is in the shared fetch() and affects every consumer.

Patches

Fixed in linuxfabrik-lib 6.0.0 (commit 6573ff9). On a cross-origin redirect (any scheme/host/port change other than a plain same-host HTTP-to-HTTPS upgrade) fetch() now keeps only benign transport headers and drops every other caller-supplied header, so credentials never follow a redirect to a different origin.

Severity
6.0 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "linuxfabrik-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67435"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T14:46:13Z",
    "nvd_published_at": "2026-07-29T20:17:12Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n`lib.url.fetch()` follows HTTP redirects (`follow_redirects=True`). httpx strips only `Authorization` and `Cookie` when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish\u0027s `X-Auth-Token`, an API key, ...) was still sent to the redirect target. A malicious or redirect-capable server can therefore answer an authenticated request with a `3xx` to an attacker-chosen host and receive the credential (server-side request forgery + token disclosure). The pre-httpx `urllib` implementation was worse: it forwarded every header, including `Authorization`, across cross-host redirects.\n\n### Impact\nAny plugin that authenticates to a host with a non-standard auth header and follows that host\u0027s redirects can be coerced into sending the credential, and an authenticated request, to another host the monitoring server can reach. The concrete case is the Redfish checks (`X-Auth-Token`), but the flaw is in the shared `fetch()` and affects every consumer.\n\n### Patches\nFixed in linuxfabrik-lib 6.0.0 (commit 6573ff9). On a cross-origin redirect (any scheme/host/port change other than a plain same-host HTTP-to-HTTPS upgrade) `fetch()` now keeps only benign transport headers and drops every other caller-supplied header, so credentials never follow a redirect to a different origin.",
  "id": "GHSA-4jc5-g844-4x33",
  "modified": "2026-07-30T14:46:13Z",
  "published": "2026-07-30T14:46:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-4jc5-g844-4x33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Linuxfabrik/lib/commit/6573ff9347e541200305d278d2663d2e54e052ff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Linuxfabrik/lib/releases/tag/v6.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect"
}

GHSA-4JCV-VP96-94XR

Vulnerability from github – Published: 2024-09-05 16:37 – Updated: 2024-11-18 16:27
VLAI
Summary
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
Details

Summary

DNS rebinding is a method of manipulating resolution of domain names to let the initial DNS query hits an address and the second hits another one. For instance the host make-190.119.176.200-rebind-127.0.0.1-rr.1u.ms would be initially resolved to 190.119.176.200 and the next DNS issue to 127.0.0.1. Please notice the following in the latest codebase:

def is_private_url(url: str):
    """
    Raises exception if url is private

    :param url: url to check
    """

    hostname = urlparse(url).hostname
    if not hostname:
        # Unable to find hostname in url
        return True
    ip = socket.gethostbyname(hostname)
    return ipaddress.ip_address(ip).is_private

As you can see, during the call to is_private_url() the initial DNS query would be issued by ip = socket.gethostbyname(hostname) to an IP (public one) and then due to DNS Rebinding, the next GET request would goes to the private one.

PoC

from flask import Flask, request, jsonify
from urllib.parse import urlparse
import socket
import ipaddress
import requests

app = Flask(__name__)


def is_private_url(url: str):
    """
    Raises exception if url is private

    :param url: url to check
    """

    hostname = urlparse(url).hostname
    if not hostname:
        # Unable to find hostname in url
        return True
    ip = socket.gethostbyname(hostname)
    if ipaddress.ip_address(ip).is_private:
        raise Exception(f"Private IP address found for {url}")


@app.route("/", methods=["GET"])
def index():
    return "http://127.0.0.1:5000/check_private_url?url=https://www.google.Fr"


@app.route("/check_private_url", methods=["GET"])
def check_private_url():
    url = request.args.get("url")

    if not url:
        return jsonify({"error": 'Missing "url" parameter'}), 400

    try:
        is_private_url(url)
        response = requests.get(url)

        return jsonify(
            {
                "url": url,
                "is_private": False,
                "text": response.text,
                "status_code": response.status_code,
            }
        )
    except Exception as e:
        return jsonify({"url": url, "is_private": True, "error": str(e)})


if __name__ == "__main__":
    app.run(debug=True)

After running the poc.py with flask installed, consider visiting the following URLs:

  1. http://127.0.0.1:5000/check_private_url?url=https://www.example.com since it is in the public space, you would get is_private: false and the GET request would be issued to the www.Example.com website.
  2. http://127.0.0.1:5000/check_private_url?url=http://localhost:8667, this one the address is private, you would get is_private: true
  3. http://127.0.0.1:5000/check_private_url?url=http://make-190.119.176.214-rebind-127.0.0.1-rr.1u.ms:8667/ But this one, it initially returns the public IP 190.119.176.214 and then DNS rebind into the network location 127.0.0.1:8667.

I set up a simple HTTP server at 127.0.0.1:8667, you can notice the results of the PoC in the next screenshot:

{
  "is_private": false,
  "status_code": 200,
  "text": "<pre>\n<a href=\"poc.py\">poc.py</a>\n</pre>\n",
  "url": "http://make-190.119.176.214-rebind-127.0.0.1-rr.1u.ms:8667/"
}

Impact

  • Bypass the SSRF protection on the whole website with DNS Rebinding.
  • DoS too.
Severity
9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
7.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mindsdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "23.12.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-24759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-350",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-05T16:37:56Z",
    "nvd_published_at": "2024-09-05T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nDNS rebinding is a method of manipulating resolution of domain names to let the initial DNS query hits an address and the second hits another one. For instance the host `make-190.119.176.200-rebind-127.0.0.1-rr.1u.ms`  would be initially resolved to `190.119.176.200` and the next DNS issue to `127.0.0.1`. Please notice the following in the latest codebase:\n\n```python\ndef is_private_url(url: str):\n    \"\"\"\n    Raises exception if url is private\n\n    :param url: url to check\n    \"\"\"\n\n    hostname = urlparse(url).hostname\n    if not hostname:\n        # Unable to find hostname in url\n        return True\n    ip = socket.gethostbyname(hostname)\n    return ipaddress.ip_address(ip).is_private\n\n``` \n\nAs you can see, during the call to `is_private_url()` the initial DNS query would be issued by `ip = socket.gethostbyname(hostname)` to an IP (public one) and then due to DNS Rebinding, the next GET request would goes to the private one.\n\n### PoC\n\n```python\nfrom flask import Flask, request, jsonify\nfrom urllib.parse import urlparse\nimport socket\nimport ipaddress\nimport requests\n\napp = Flask(__name__)\n\n\ndef is_private_url(url: str):\n    \"\"\"\n    Raises exception if url is private\n\n    :param url: url to check\n    \"\"\"\n\n    hostname = urlparse(url).hostname\n    if not hostname:\n        # Unable to find hostname in url\n        return True\n    ip = socket.gethostbyname(hostname)\n    if ipaddress.ip_address(ip).is_private:\n        raise Exception(f\"Private IP address found for {url}\")\n\n\n@app.route(\"/\", methods=[\"GET\"])\ndef index():\n    return \"http://127.0.0.1:5000/check_private_url?url=https://www.google.Fr\"\n\n\n@app.route(\"/check_private_url\", methods=[\"GET\"])\ndef check_private_url():\n    url = request.args.get(\"url\")\n\n    if not url:\n        return jsonify({\"error\": \u0027Missing \"url\" parameter\u0027}), 400\n\n    try:\n        is_private_url(url)\n        response = requests.get(url)\n\n        return jsonify(\n            {\n                \"url\": url,\n                \"is_private\": False,\n                \"text\": response.text,\n                \"status_code\": response.status_code,\n            }\n        )\n    except Exception as e:\n        return jsonify({\"url\": url, \"is_private\": True, \"error\": str(e)})\n\n\nif __name__ == \"__main__\":\n    app.run(debug=True)\n\n```\n\nAfter running the poc.py with flask installed, consider visiting the following URLs:\n\n1. http://127.0.0.1:5000/check_private_url?url=https://www.example.com since it is in the public space, you would get `is_private: false` and the GET request would be issued to the www.Example.com website.\n3. http://127.0.0.1:5000/check_private_url?url=http://localhost:8667, this one the address is private, you would get `is_private: true`\n4. http://127.0.0.1:5000/check_private_url?url=http://make-190.119.176.214-rebind-127.0.0.1-rr.1u.ms:8667/ But this one, it initially returns the public IP `190.119.176.214` and then DNS rebind into the network location `127.0.0.1:8667`.\n\nI set up a simple HTTP server at `127.0.0.1:8667`, you can notice the results of the PoC in the next screenshot:\n\n```\n{\n  \"is_private\": false,\n  \"status_code\": 200,\n  \"text\": \"\u003cpre\u003e\\n\u003ca href=\\\"poc.py\\\"\u003epoc.py\u003c/a\u003e\\n\u003c/pre\u003e\\n\",\n  \"url\": \"http://make-190.119.176.214-rebind-127.0.0.1-rr.1u.ms:8667/\"\n}\n\n```\n\n\n### Impact\n - Bypass the SSRF protection on the whole website with DNS Rebinding.\n - DoS too.\n",
  "id": "GHSA-4jcv-vp96-94xr",
  "modified": "2024-11-18T16:27:10Z",
  "published": "2024-09-05T16:37:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24759"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mindsdb/mindsdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding"
}

GHSA-4JG5-6FPG-J2HG

Vulnerability from github – Published: 2026-04-30 00:31 – Updated: 2026-04-30 00:31
VLAI
Details

A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-7417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-29T22:16:22Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-4jg5-6fpg-j2hg",
  "modified": "2026-04-30T00:31:21Z",
  "published": "2026-04-30T00:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Algovate/xhs-mcp/issues/6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BruceJqs/public_exp/issues/21"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Algovate/xhs-mcp"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/803991"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360154"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360154/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4JXF-PWGR-9M4J

Vulnerability from github – Published: 2026-02-25 06:31 – Updated: 2026-02-25 06:31
VLAI
Details

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T06:16:26Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-4jxf-pwgr-9m4j",
  "modified": "2026-02-25T06:31:15Z",
  "published": "2026-02-25T06:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3163"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@hemantrajbhati5555/ssrf-vulnerability-in-sourcecodester-website-link-extractor-v1-0-5df6bb708f5e"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.347670"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.347670"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.758932"
    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4M2J-2X3W-GG93

Vulnerability from github – Published: 2026-06-29 18:31 – Updated: 2026-06-29 18:31
VLAI
Details

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-56285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-29T18:16:38Z",
    "severity": "HIGH"
  },
  "details": "Nitter\u0027s /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.",
  "id": "GHSA-4m2j-2x3w-gg93",
  "modified": "2026-06-29T18:31:55Z",
  "published": "2026-06-29T18:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56285"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zedeus/nitter/issues/1411"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4MG4-WVMX-5332

Vulnerability from github – Published: 2021-06-15 16:11 – Updated: 2024-10-18 21:49
VLAI
Summary
Server-Side Request Forgery in Plone
Details

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Plone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-33510"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-27T21:39:48Z",
    "nvd_published_at": "2021-05-21T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.",
  "id": "GHSA-4mg4-wvmx-5332",
  "modified": "2024-10-18T21:49:19Z",
  "published": "2021-06-15T16:11:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33510"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4mg4-wvmx-5332"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plone/Plone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-82.yaml"
    },
    {
      "type": "WEB",
      "url": "https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/05/22/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Server-Side Request Forgery in Plone"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list