Weaknesses of type CWE-918

3,106 results

Falsificação de Solicitação no Servidor (SSRF)

O servidor web recupera conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Isso permite que um atacante force o servidor a fazer requisições para hosts internos, serviços privados ou sistemas que não deveriam ser acessíveis, contornando controles de rede e autenticação.

Example

Uma aplicação oferece um proxy de imagens: recebe a URL 'http://exemplo.com/foto.jpg' e retorna o conteúdo. Um atacante envia 'http://localhost:8080/admin' ou 'http://192.168.1.100/dados-internos', forçando o servidor a acessar sistemas internos e exfiltrar dados sensíveis.

How to mitigate

Valide e faça whitelist de domínios/IPs permitidos antes de fazer a requisição; rejeite URLs locais, privadas (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) e metadados (169.254.169.254); use DNS pinning e resoluções contínuas. Em clouds, restrinja acesso ao serviço de metadados via iptables ou IMDSv2.

CVE-2025-13147MEDIUMExternal Service Interaction (DNS)EPSS 0.3%CVE-2025-8529MEDIUMcloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgeryEPSS 0.3%CVE-2026-100858HIGHheym before 0.0.109 Server-Side Request Forgery via Workflow NodesEPSS 0.3%CVE-2025-67961MEDIUMWordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2024-46413MEDIUMRebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBEPSS 0.3%CVE-2026-36469CRITICALCuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload EPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%CVE-2025-32358MEDIUMIn Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests EPSS 0.3%CVE-2026-29107MEDIUMSuiteCRM vulnerable to authenticated SSRF via PDF exportEPSS 0.3%CVE-2026-32473HIGHWordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-66704HIGHWordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-61953HIGHWordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-57372HIGHWordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-57407HIGHWordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-59552HIGHWordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-65516HIGHWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2025-15613MEDIUMKyverno before v1.13.4 SSRF via Service CallEPSS 0.3%CVE-2026-59278MEDIUMIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesEPSS 0.3%CVE-2026-32553HIGHWordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2025-9395MEDIUMwangsongyan wblog backup.go RestorePost server-side request forgeryEPSS 0.3%