Filtered by CWE-918
Filtered by vendor Subscriptions
Total 1557 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-3254 2025-04-07 6.3 Medium
A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-28091 1 Maccms 1 Maccms 2025-04-07 9.1 Critical
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
CVE-2025-28092 1 Shopxo 1 Shopxo 2025-04-07 6.3 Medium
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
CVE-2025-28093 1 Shopxo 1 Shopxo 2025-04-07 6.3 Medium
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
CVE-2025-28094 1 Shopxo 1 Shopxo 2025-04-07 6.5 Medium
shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.
CVE-2025-28096 1 Onenav 1 Onenav 2025-04-07 5.4 Medium
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.
CVE-2022-45926 1 Opentext 1 Opentext Extended Ecm 2025-04-04 8.8 High
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.
CVE-2024-38791 1 Meowapps 1 Ai Engine 2025-04-04 4.9 Medium
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
CVE-2025-1548 1 Iteachyou 1 Dreamer Cms 2025-04-04 3.5 Low
A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archives/edit. The manipulation of the argument editorValue/answer/content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-12450 1 Infiniflow 1 Ragflow 2025-04-04 9.8 Critical
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.
CVE-2004-2061 1 Risearch 2 Risearch, Risearch Pro 2025-04-03 9.8 Critical
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.
CVE-2002-1484 1 Siemens 1 Db4web 2025-04-03 9.8 Critical
DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.
CVE-2024-35635 1 Wpmanageninja 1 Ninja Tables 2025-04-03 4.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
CVE-2021-22986 1 F5 15 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 12 more 2025-04-02 9.8 Critical
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVE-2024-32430 1 Activecampaign 1 Activecampaign 2025-04-02 4.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14.
CVE-2021-21985 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-04-02 9.8 Critical
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVE-2023-23560 1 Lexmark 256 B2236, B2236 Firmware, B2338 and 253 more 2025-04-02 9.8 Critical
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
CVE-2021-43449 1 Onlyoffice 1 Server 2025-04-02 8.1 High
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
CVE-2025-21385 1 Microsoft 1 Purview 2025-04-02 8.8 High
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
CVE-2024-13838 1 Uncannyowl 1 Uncanny Automator 2025-04-02 5.5 Medium
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'call_webhook' method of the Automator_Send_Webhook class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.