CWE-918

mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, ma

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's con

The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. T

An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, whi

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files usin

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue af

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. T

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Reques

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.control

Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal

Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8

Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9

Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8

alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to

IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker

MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP servic

The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the fil

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, wh

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testi

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9

The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfi

Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.

Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by impro

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Cha

Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url

Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' fun

In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that

Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.

The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, fo

Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrus

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user w

Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For

Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF)

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attac

Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.