CWE-918

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Requ

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's prox

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML Ex

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an a

Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code a

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac

A server-side request forgery (SSRF) was discovered in the Akana API Platform in versions prior to and including 2022.1.

A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the e

The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in a

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated a

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat ac

Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostn

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` d

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2

An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via t

Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to exec

Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior

A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSR

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework u

hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\

Oxide control plane software before 5 allows SSRF.

Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forger

Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validat

The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control ex

An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load

An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to t

mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoin

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This

PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?

PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#mainten

A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through e

Loftware Spectrum before 5.1 allows SSRF.

Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,

A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to

Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sens

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within t

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.