Server Side Request Forgery (SSRF)

spatie/browsershot is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to a missing restriction on user input in the setUrl function, allowing attackers to access localhost and list its directories...

CVE-2025-3572

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

CVE-2025-3572

CVE-2025-3572 concerns a Server-Side Request Forgery in INTUMIT’s SmartRobot. The issue allows unauthenticated remote attackers to probe internal networks and access arbitrary local files on the server via SSRF in the affected SmartRobot component. Public listings consistently describe the vulner...

CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server...

CVE-2025-29720

Dify v1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component controllers.console.remotefiles.RemoteFileUploadApi...

📄 CrushFTP 9.x / 10.8.4 / 11.3.1 Server-Side Request Forgery / Directory Traversal

CrushFTP versions 9.x, 10.x through 10.8.4, and 11.x through 11.3.1 suffer from server-side request forgery and directory traversal vulnerabilities. !-- Exploit Title: Server-Side Request Forgery SSRF in CrushFTP 10.7.1 and 11.1.0 as well as legacy 9.x Date: 2024-10-20 Exploit Author: Rafael...

CVE-2025-29720

Dify v1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component controllers.console.remotefiles.RemoteFileUploadApi...

CVE-2025-29720

Dify v1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component controllers.console.remotefiles.RemoteFileUploadApi...

PT-2025-16259 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify version 1.0 Description: The issue is related to a Server-Side Request Forgery SSRF via the component controllers.console.remote files.RemoteFileUploadApi. This allows for potential unauthorized access to internal resources...

CVE-2025-29720

CVE-2025-29720 describes a Server-Side Request Forgery (SSRF) in Dify via controllers.console.remote_files.RemoteFileUploadApi affecting Dify v1.0 (and references to v1.6.0 in related advisories). The underlying issue is a component exposure that can be triggered locally with user interaction req...

PT-2025-16277 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in AutoGPT, which is caused by DNS Rebinding in the requests wrapper. This allows an attacker to bypass the validation of th...

PT-2025-16193 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: CrushFTP versions 9.x through 11.3.1 Description: The issue allows for Server-Side Request Forgery SSRF via the host and port parameters in a command=telnetSocket request to the "/WebInterface/function/" URI. This vulnerability can be exploit...

CVE-2025-22374

A Server-Side Request Forgery SSRF vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatched could lead to unauthorized access to...

CVE-2025-32487

Server-Side Request Forgery SSRF vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through = 1.5.2...

CVE-2025-32691

Server-Side Request Forgery SSRF vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through = 11.12.6...

CVE-2025-32675

Server-Side Request Forgery SSRF vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a through = 6.7.9...

CVE-2025-31009

Server-Side Request Forgery SSRF vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through = 0.13.1...

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, surreal start --allow-net --deny-net 10.0.0.0/8 will allow a...

GHSA-5Q9X-554G-9JGG SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, surreal start --allow-net --deny-net 10.0.0.0/8 will allow a...