Total
1663 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-49418 | 2025-07-08 | N/A | 7.2 HIGH | ||
| Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allows Server Side Request Forgery. This issue affects Allmart: from n/a through 1.0.0. | |||||
| CVE-2025-53473 | 2025-07-08 | N/A | 7.3 HIGH | ||
| Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers. | |||||
| CVE-2025-7103 | 2025-07-08 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-42965 | 2025-07-08 | N/A | 4.1 MEDIUM | ||
| SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application. | |||||
| CVE-2024-48232 | 1 Mipjz Project | 1 Mipjz | 2025-07-07 | N/A | 4.9 MEDIUM |
| An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files. | |||||
| CVE-2024-29030 | 1 Usememos | 1 Memos | 2025-07-07 | N/A | 5.8 MEDIUM |
| memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file. | |||||
| CVE-2024-29028 | 1 Usememos | 1 Memos | 2025-07-07 | N/A | 5.8 MEDIUM |
| memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1. | |||||
| CVE-2025-2940 | 1 Wpmanageninja | 1 Ninja Tables | 2025-07-07 | N/A | 7.2 HIGH |
| The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. | |||||
| CVE-2024-51463 | 1 Ibm | 1 I | 2025-07-03 | N/A | 5.4 MEDIUM |
| IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2025-52491 | 2025-07-03 | N/A | 5.8 MEDIUM | ||
| Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. | |||||
| CVE-2025-34051 | 2025-07-03 | N/A | N/A | ||
| A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services. | |||||
| CVE-2023-37229 | 1 Loftware | 1 Spectrum | 2025-07-03 | N/A | 8.8 HIGH |
| Loftware Spectrum before 5.1 allows SSRF. | |||||
| CVE-2025-23082 | 1 Veeam | 1 Veeam Backup For Microsoft Azure | 2025-07-03 | N/A | 7.2 HIGH |
| Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2024-35451 | 1 Linkstack | 1 Linkstack | 2025-07-03 | N/A | 4.8 MEDIUM |
| LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF. | |||||
| CVE-2024-45206 | 1 Veeam | 1 Veeam Service Provider Console | 2025-07-02 | N/A | 6.5 MEDIUM |
| A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources. | |||||
| CVE-2025-37090 | 1 Hpe | 1 Storeonce System | 2025-07-02 | N/A | 9.8 CRITICAL |
| A server-side request forgery vulnerability exists in HPE StoreOnce Software. | |||||
| CVE-2025-0539 | 2 Microsoft, Octopus | 2 Windows, Octopus Server | 2025-07-02 | N/A | 8.8 HIGH |
| In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself. | |||||
| CVE-2025-49852 | 1 Assaabloy | 1 Control Id Idsecure | 2025-07-02 | N/A | 7.5 HIGH |
| ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers. | |||||
| CVE-2024-48360 | 1 Qualitor | 1 Qualitor | 2025-07-01 | N/A | 7.5 HIGH |
| Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php. | |||||
| CVE-2024-38472 | 2 Apache, Netapp | 2 Http Server, Ontap | 2025-07-01 | N/A | 7.5 HIGH |
| SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing. | |||||