CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2024-6584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-15T20:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "The \u0027wp_ajax_boost_proxy_ig\u0027 action allows administrators to make GET requests to arbitrary URLs.",
  "id": "GHSA-gmhj-76hp-7wh3",
  "modified": "2025-05-17T06:30:24Z",
  "published": "2025-05-15T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6584"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-31897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-08T03:15:02Z",
    "severity": "MODERATE"
  },
  "details": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  288178.",
  "id": "GHSA-gmp6-hg9q-f8gw",
  "modified": "2024-07-08T03:32:13Z",
  "published": "2024-07-08T03:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31897"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7159332"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "processwire/processwire"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.255"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40500"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T22:28:24Z",
    "nvd_published_at": "2026-04-15T22:17:22Z",
    "severity": "MODERATE"
  },
  "details": "ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel\u0027s \u0027Add Module From URL\u0027 feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.",
  "id": "GHSA-gmwr-9j4p-96vm",
  "modified": "2026-04-16T22:28:24Z",
  "published": "2026-04-16T00:54:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40500"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/processwire/processwire"
    },
    {
      "type": "WEB",
      "url": "https://processwire.com"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ProcessWire: server-side request forgery vulnerability in the admin panel\u0027s \u0027Add Module From URL\u0027 feature"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "koillection/koillection"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T16:44:47Z",
    "nvd_published_at": "2026-06-15T20:16:31Z",
    "severity": "HIGH"
  },
  "details": "An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL.",
  "id": "GHSA-gmxh-hjfv-qc2w",
  "modified": "2026-08-27T16:44:47Z",
  "published": "2026-06-15T21:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benjaminjonard/koillection/pull/1599"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benjaminjonard/koillection/commit/4d445e21c631c26070f19fe8ec086a2939767ae0"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/pyuysig/d60273c1c346257ceddbf8da7134bae7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/benjaminjonard/koillection"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benjaminjonard/koillection/releases/tag/1.8.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Koillection has an authenticated Server-Side Request Forgery issue"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-49159"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-15T16:15:43Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.",
  "id": "GHSA-gp3h-jq5w-chrc",
  "modified": "2026-04-28T21:33:21Z",
  "published": "2023-12-15T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49159"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/commentluv/wordpress-commentluv-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-85172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T13:06:24Z",
    "severity": "MODERATE"
  },
  "details": "n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.",
  "id": "GHSA-gp6f-26pc-fr6h",
  "modified": "2026-09-16T21:31:37Z",
  "published": "2026-09-03T15:32:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85172"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-55976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T11:16:53Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\n\n\nAttacker access requirements:\n\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\n  *  Valid Hive authentication: required.\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\n\n\n\n\nDetection guidance:\n\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.",
  "id": "GHSA-gp8m-92x3-q87g",
  "modified": "2026-08-26T21:31:33Z",
  "published": "2026-08-25T12:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55976"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/hive"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/HIVE-29671"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-02T23:15:58Z",
    "severity": "HIGH"
  },
  "details": "IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A\u00a0remote attacker could exploit this vulnerability to expose sensitive information or consume memory\u00a0resources.",
  "id": "GHSA-gpf2-rxq3-v5rj",
  "modified": "2026-02-03T00:30:18Z",
  "published": "2026-02-03T00:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13096"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7259321"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-42183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-31T20:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).",
  "id": "GHSA-gpp3-cp4h-g5wg",
  "modified": "2024-04-04T06:27:40Z",
  "published": "2023-07-31T21:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42183"
    },
    {
      "type": "WEB",
      "url": "https://docs.precisely.com/docs/sftw/spectrum/release-notes/spectrum-2020-1-S56-release-notes.pdf"
    },
    {
      "type": "WEB",
      "url": "https://zxsecurity.co.nz/research/advisories/precisely-spectrum-spatial-analyst-20-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-69543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-20T22:18:00Z",
    "severity": "HIGH"
  },
  "details": "Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.",
  "id": "GHSA-gpqg-pwjf-mjxw",
  "modified": "2026-08-21T00:31:22Z",
  "published": "2026-08-21T00:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69543"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69543"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}