CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5993 vulnerabilities reference this CWE, most recent first.
GHSA-88GP-Q3V3-9QMM
Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2025-04-16 15:34A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-3691"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T13:15:53Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-88gp-q3v3-9qmm",
"modified": "2025-04-16T15:34:38Z",
"published": "2025-04-16T15:34:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3691"
},
{
"type": "WEB",
"url": "https://github.com/KKDT12138/CVE/blob/main/cve2.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304980"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304980"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553507"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-88QF-P934-H9QG
Vulnerability from github – Published: 2026-03-19 21:30 – Updated: 2026-03-19 21:30Server-side request forgery (ssrf) in Microsoft 365 Copilot's Business Chat allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2026-26137"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-19T21:17:08Z",
"severity": "HIGH"
},
"details": "Server-side request forgery (ssrf) in Microsoft 365 Copilot\u0027s Business Chat allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-88qf-p934-h9qg",
"modified": "2026-03-19T21:30:24Z",
"published": "2026-03-19T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26137"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-88RQ-V8PM-8JVF
Vulnerability from github – Published: 2026-09-18 15:32 – Updated: 2026-09-18 15:32A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
{
"affected": [],
"aliases": [
"CVE-2026-93506"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T15:17:19Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.",
"id": "GHSA-88rq-v8pm-8jvf",
"modified": "2026-09-18T15:32:19Z",
"published": "2026-09-18T15:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93506"
},
{
"type": "WEB",
"url": "https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f"
},
{
"type": "WEB",
"url": "https://github.com/SveltyCMS/SveltyCMS"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-93506"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/942851"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/407423"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/407423/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-88W2-CJHC-67M3
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-29166"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-03T13:15:00Z",
"severity": "HIGH"
},
"details": "PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.",
"id": "GHSA-88w2-cjhc-67m3",
"modified": "2022-05-24T17:40:48Z",
"published": "2022-05-24T17:40:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29166"
},
{
"type": "WEB",
"url": "https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d"
},
{
"type": "WEB",
"url": "https://pacsone.net/download.htm"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8975-RXWF-WQ3J
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-4200"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:20:04Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8975-rxwf-wq3j",
"modified": "2026-03-16T15:30:45Z",
"published": "2026-03-16T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4200"
},
{
"type": "WEB",
"url": "https://fx4tqqfvdw4.feishu.cn/docx/K0SjdZTPRo31LExSdlfcC3jwn1c?from=from_copylink"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.351112"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.351112"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.770476"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8977-R7MX-5HVR
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-09-15 00:00An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.
{
"affected": [],
"aliases": [
"CVE-2020-35558"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T16:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.",
"id": "GHSA-8977-r7mx-5hvr",
"modified": "2022-09-15T00:00:20Z",
"published": "2022-05-24T17:42:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35558"
},
{
"type": "WEB",
"url": "https://cert.vde.com/de-de/advisories/vde-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2022-039"
},
{
"type": "WEB",
"url": "https://mbconnectline.com/security-advice"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-899P-4HPJ-22F4
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-16 00:01IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.
{
"affected": [],
"aliases": [
"CVE-2022-22339"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-08T16:15:00Z",
"severity": "HIGH"
},
"details": "IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.",
"id": "GHSA-899p-4hpj-22f4",
"modified": "2022-04-16T00:01:28Z",
"published": "2022-04-09T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22339"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219736"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6565099"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-89FC-CVXQ-Q6PV
Vulnerability from github – Published: 2022-04-08 00:00 – Updated: 2022-04-15 00:00Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.
{
"affected": [],
"aliases": [
"CVE-2021-36202"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-07T20:15:00Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.",
"id": "GHSA-89fc-cvxq-q6pv",
"modified": "2022-04-15T00:00:59Z",
"published": "2022-04-08T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36202"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-02"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-89H6-69JQ-V92C
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2021-29844"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-27T16:15:00Z",
"severity": "HIGH"
},
"details": "IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-89h6-69jq-v92c",
"modified": "2022-05-24T19:18:56Z",
"published": "2022-05-24T19:18:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29844"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/205205"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6508583"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-89HJ-33Q6-8644
Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 18:31A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
{
"affected": [],
"aliases": [
"CVE-2026-15732"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T22:16:48Z",
"severity": "CRITICAL"
},
"details": "A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.",
"id": "GHSA-89hj-33q6-8644",
"modified": "2026-08-07T18:31:37Z",
"published": "2026-08-07T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15732"
},
{
"type": "WEB",
"url": "https://github.com/Stuub/WGDashboard-v4.3.2-Full-Read-SSRF-via-Webhooks-PoC"
},
{
"type": "WEB",
"url": "https://github.com/WGDashboard/WGDashboard"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.