CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4835 vulnerabilities reference this CWE, most recent first.
GHSA-68CQ-25F3-7RG7
Vulnerability from github – Published: 2025-09-03 15:30 – Updated: 2026-04-01 18:36Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.
{
"affected": [],
"aliases": [
"CVE-2025-58615"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T15:15:43Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.",
"id": "GHSA-68cq-25f3-7rg7",
"modified": "2026-04-01T18:36:02Z",
"published": "2025-09-03T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58615"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-bannerize-pro/vulnerability/wordpress-wp-bannerize-pro-plugin-1-10-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G7-C8WC-89PQ
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-16 15:30Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.
{
"affected": [],
"aliases": [
"CVE-2026-32357"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:49Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through \u003c= 2.37.",
"id": "GHSA-68g7-c8wc-89pq",
"modified": "2026-03-16T15:30:35Z",
"published": "2026-03-13T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32357"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G8-C275-XF2M
Vulnerability from github – Published: 2024-09-18 17:42 – Updated: 2024-09-18 19:25Impact
If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices (like 127.0.0.2 - 127.127.127.127)
Workaround
You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just 127.0.0.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.13.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "22.0.0"
},
{
"fixed": "22.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-46990"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-18T17:42:05Z",
"nvd_published_at": "2024-09-18T17:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nIf you\u0027re relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)\n\n### Workaround\nYou can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.\n\n",
"id": "GHSA-68g8-c275-xf2m",
"modified": "2024-09-18T19:25:25Z",
"published": "2024-09-18T17:42:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46990"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Directus vulnerable to SSRF Loopback IP filter bypass"
}
GHSA-68R5-9HPG-7QW9
Vulnerability from github – Published: 2026-07-24 21:46 – Updated: 2026-07-24 21:46The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.1.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.openidentityplatform.opendj:opendj-dsml-servlet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-73",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T21:46:06Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.",
"id": "GHSA-68r5-9hpg-7qw9",
"modified": "2026-07-24T21:46:06Z",
"published": "2026-07-24T21:46:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway"
}
GHSA-6927-5WRV-GQX4
Vulnerability from github – Published: 2025-01-15 18:30 – Updated: 2026-04-28 21:35Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.
{
"affected": [],
"aliases": [
"CVE-2025-22346"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T16:15:34Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.",
"id": "GHSA-6927-5wrv-gqx4",
"modified": "2026-04-28T21:35:30Z",
"published": "2025-01-15T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22346"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/course-migration-for-learndash/vulnerability/wordpress-course-migration-for-learndash-plugin-1-0-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6964-PP88-6WP9
Vulnerability from github – Published: 2026-06-12 15:08 – Updated: 2026-06-12 15:08Summary
The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.
Details
Inside the execute query automation step, the queryId value and any additional query parameters from inputs.query are assembled into a request context and forwarded to queryController.executeV2AsAutomation. The constructed context looks like the following:
const ctx: any = buildCtx(appId, emitter, {
body: {
parameters: rest,
},
params: {
queryId,
},
user: context.user,
})
No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The context.user value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.
To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.
The key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.
PoC
curl -s -X POST "$BUDIBASE_HOST/api/datasources" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d '{
"datasource": {
"name": "internal-meta",
"type": "REST",
"source": "REST",
"config": {
"url": "http://169.254.169.254",
"rejectUnauthorized": false,
"defaultHeaders": {}
}
}
}'
curl -s -X POST "$BUDIBASE_HOST/api/queries" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d "{
\"datasourceId\": \"$DATASOURCE_ID\",
\"name\": \"meta-probe\",
\"queryVerb\": \"read\",
\"fields\": {
\"path\": \"/latest/meta-data/\",
\"queryString\": \"\",
\"headers\": {},
\"requestBody\": \"\"
},
\"parameters\": [],
\"transformer\": \"return data\",
\"schema\": {}
}"
curl -s -X POST "$BUDIBASE_HOST/api/automations" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d "{
\"name\": \"ssrf-test\",
\"definition\": {
\"trigger\": {
\"event\": \"app:trigger\",
\"stepId\": \"APP\",
\"inputs\": {},
\"schema\": {\"inputs\": {\"properties\": {}, \"required\": []}},
\"type\": \"TRIGGER\",
\"id\": \"trigger1\"
},
\"steps\": [
{
\"stepId\": \"EXECUTE_QUERY\",
\"inputs\": {
\"query\": {
\"queryId\": \"$QUERY_ID\"
}
},
\"schema\": {},
\"type\": \"ACTION\",
\"id\": \"step1\"
}
]
}
}"
curl -s -X POST "$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d '{}'
Impact
An authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "budibase"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.39.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48128"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T15:08:23Z",
"nvd_published_at": "2026-05-27T18:16:26Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.\n\n### Details\n\nInside the execute query automation step, the queryId value and any additional query parameters from `inputs.query` are assembled into a request context and forwarded to `queryController.executeV2AsAutomation`. The constructed context looks like the following:\n\n```typescript\nconst ctx: any = buildCtx(appId, emitter, {\n body: {\n parameters: rest,\n },\n params: {\n queryId,\n },\n user: context.user,\n})\n```\n\nNo validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The `context.user` value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.\n\nTo reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.\n\nThe key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.\n\n### PoC\n\n```bash\ncurl -s -X POST \"$BUDIBASE_HOST/api/datasources\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\n \"datasource\": {\n \"name\": \"internal-meta\",\n \"type\": \"REST\",\n \"source\": \"REST\",\n \"config\": {\n \"url\": \"http://169.254.169.254\",\n \"rejectUnauthorized\": false,\n \"defaultHeaders\": {}\n }\n }\n }\u0027\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/queries\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\n \\\"datasourceId\\\": \\\"$DATASOURCE_ID\\\",\n \\\"name\\\": \\\"meta-probe\\\",\n \\\"queryVerb\\\": \\\"read\\\",\n \\\"fields\\\": {\n \\\"path\\\": \\\"/latest/meta-data/\\\",\n \\\"queryString\\\": \\\"\\\",\n \\\"headers\\\": {},\n \\\"requestBody\\\": \\\"\\\"\n },\n \\\"parameters\\\": [],\n \\\"transformer\\\": \\\"return data\\\",\n \\\"schema\\\": {}\n }\"\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/automations\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\n \\\"name\\\": \\\"ssrf-test\\\",\n \\\"definition\\\": {\n \\\"trigger\\\": {\n \\\"event\\\": \\\"app:trigger\\\",\n \\\"stepId\\\": \\\"APP\\\",\n \\\"inputs\\\": {},\n \\\"schema\\\": {\\\"inputs\\\": {\\\"properties\\\": {}, \\\"required\\\": []}},\n \\\"type\\\": \\\"TRIGGER\\\",\n \\\"id\\\": \\\"trigger1\\\"\n },\n \\\"steps\\\": [\n {\n \\\"stepId\\\": \\\"EXECUTE_QUERY\\\",\n \\\"inputs\\\": {\n \\\"query\\\": {\n \\\"queryId\\\": \\\"$QUERY_ID\\\"\n }\n },\n \\\"schema\\\": {},\n \\\"type\\\": \\\"ACTION\\\",\n \\\"id\\\": \\\"step1\\\"\n }\n ]\n }\n }\"\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{}\u0027\n```\n\n### Impact\n\nAn authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process.",
"id": "GHSA-6964-pp88-6wp9",
"modified": "2026-06-12T15:08:23Z",
"published": "2026-06-12T15:08:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48128"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step"
}
GHSA-698X-9W2P-7VVP
Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-07-07 23:47A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/quay/claircore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.5.52"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10517"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T23:47:00Z",
"nvd_published_at": "2026-06-01T09:16:16Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.",
"id": "GHSA-698x-9w2p-7vvp",
"modified": "2026-07-07T23:47:00Z",
"published": "2026-06-01T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10517"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-10517"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486779"
},
{
"type": "PACKAGE",
"url": "https://github.com/quay/claircore"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints"
}
GHSA-69Q6-WH98-33QX
Vulnerability from github – Published: 2025-04-08 06:30 – Updated: 2025-04-08 06:30A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3412"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T06:15:44Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-69q6-wh98-33qx",
"modified": "2025-04-08T06:30:40Z",
"published": "2025-04-08T06:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3412"
},
{
"type": "WEB",
"url": "https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_SSRF2.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.303690"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.303690"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.544289"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6C4P-F5HF-9795
Vulnerability from github – Published: 2023-03-30 15:30 – Updated: 2023-03-30 15:30Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery.This issue affects Project Management System: before 4.09.31.125.
{
"affected": [],
"aliases": [
"CVE-2023-1725"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-30T15:15:00Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery.This issue affects Project Management System: before 4.09.31.125.",
"id": "GHSA-6c4p-f5hf-9795",
"modified": "2023-03-30T15:30:19Z",
"published": "2023-03-30T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1725"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C5H-GG2J-QP46
Vulnerability from github – Published: 2022-03-29 00:01 – Updated: 2022-04-05 00:00A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
{
"affected": [],
"aliases": [
"CVE-2022-0136"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-28T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.",
"id": "GHSA-6c5h-gg2j-qp46",
"modified": "2022-04-05T00:00:48Z",
"published": "2022-03-29T00:01:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0136"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/560658"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/28561"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.