HexBrain
Sign in

Browse / Server-Side Request Forgery

Server-Side Request Forgery

329disclosed reports
1weaknesses
$178,559paid in bounties

See it on the mapBypass libraryPayloads

Weaknesses in this class

Often found together with

Most upvoted Server-Side Request Forgery reports

AllValidInformativeN/ADuplicate

  1. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium · Shopify
    587 votes
  2. Server Side Request Forgery (SSRF) via Analytics ReportsServer-Side Request Forgery (SSRF) · critical · HackerOne
    $25,000529 votes
  3. Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataServer-Side Request Forgery (SSRF) · Snapchat
    421 votes
  4. SSRF on project import via the remote_attachment_url on a NoteServer-Side Request Forgery (SSRF) · high · GitLab
    $10,000359 votes
  5. Server Side Request Forgery mitigation bypassServer-Side Request Forgery (SSRF) · high · GitLab
    350 votes
  6. Blind SSRF to internal services in matrix preview_link APIServer-Side Request Forgery (SSRF) · high · Reddit
    $6,000344 votes
  7. TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesServer-Side Request Forgery (SSRF) · critical · Slack
    $3,500323 votes
  8. SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Server-Side Request Forgery (SSRF) · critical · Vimeo
    276 votes
  9. Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionServer-Side Request Forgery (SSRF) · critical · Evernote
    264 votes
  10. SSRF in graphQL query (pwapi.ex2b.com)Server-Side Request Forgery (SSRF) · medium · EXNESS
    $3,000261 votes
  11. Unauthenticated blind SSRF in OAuth Jira authorization controllerServer-Side Request Forgery (SSRF) · high · GitLab
    $4,000238 votes
  12. Full Read SSRF on Gitlab's Internal GrafanaServer-Side Request Forgery (SSRF) · critical · GitLab
    229 votes
  13. SSRF in webhooks leads to AWS private keys disclosureServer-Side Request Forgery (SSRF) · high · Omise
    214 votes
  14. Stored XSS & SSRF in Lark DocsServer-Side Request Forgery (SSRF) · critical · Lark Technologies
    $3,000178 votes
  15. SSRF on duckduckgo.com/iu/Server-Side Request Forgery (SSRF) · high · DuckDuckGo
    165 votes
  16. Server Side Request ForgeryServer-Side Request Forgery (SSRF) · critical · Lark Technologies
    164 votes
  17. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingServer-Side Request Forgery (SSRF) · high · TikTok
    $2,727162 votes
  18. SSRF in Autodesk Rendering leading to account takeoverServer-Side Request Forgery (SSRF) · critical · Autodesk
    161 votes
  19. SSRF chained to hit internal host leading to another SSRF which allows to read internal images.Server-Side Request Forgery (SSRF) · high · PlayStation
    $1,000148 votes
  20. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF) · PortSwigger Web Security
    144 votes
  21. Blind SSRF on errors.hackerone.net due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low · HackerOne
    $3,500143 votes
  22. SSRF in https://couriers.indrive.com/api/file-storageServer-Side Request Forgery (SSRF) · high · inDrive
    141 votes
  23. Server Side Request Forgery (SSRF) in webhook functionalityServer-Side Request Forgery (SSRF) · medium · HackerOne
    $2,500140 votes
  24. SSRF on music.line.me through getXML.phpServer-Side Request Forgery (SSRF) · high · LY Corporation
    $4,500135 votes
  25. SSRF In Get Video ContentsServer-Side Request Forgery (SSRF) · medium · Semrush
    125 votes
  26. Full read SSRF via Lark Docs `import as docs` feature Server-Side Request Forgery (SSRF) · critical · Lark Technologies
    $5,000124 votes
  27. Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumerationServer-Side Request Forgery (SSRF) · medium · EXNESS
    120 votes
  28. Server-Side Request Forgery (SSRF) via Game Export APIServer-Side Request Forgery (SSRF) · critical · Lichess
    116 votes
  29. [H1-415 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical · h1-ctf
    108 votes
  30. SSRF on image rendererServer-Side Request Forgery (SSRF) · high · PlayStation
    $1,000103 votes
  31. Header modification results in disclosure of Slack infra metadata to unauthorized partiesServer-Side Request Forgery (SSRF) · medium · Slack
    97 votes
  32. [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierServer-Side Request Forgery (SSRF) · critical · Stripo Inc
    92 votes
  33. Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerServer-Side Request Forgery (SSRF) · medium · Shopify
    $1,00090 votes
  34. SSRF and LFI in site-audit toolServer-Side Request Forgery (SSRF) · high · Semrush
    86 votes
  35. SSRF in api.slack.com, using slash commands and bypassing the protections.Server-Side Request Forgery (SSRF) · medium · Slack
    84 votes
  36. Blind SSRF in emblem editor (2)Server-Side Request Forgery (SSRF) · medium · Rockstar Games
    $1,50083 votes
  37. SVG Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) · low · Shopify
    $50081 votes
  38. SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Server-Side Request Forgery (SSRF) · medium · DuckDuckGo
    $50077 votes
  39. SSRF via host header let access localhost via https://go.dialexa.comServer-Side Request Forgery (SSRF) · medium · IBM
    75 votes
  40. Libuv: Improper Domain Lookup that potentially leads to SSRF attacksServer-Side Request Forgery (SSRF) · high · Internet Bug Bounty
    $4,86074 votes
  41. GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryServer-Side Request Forgery (SSRF) · high · GitLab
    72 votes
  42. SSRF in CI after first runServer-Side Request Forgery (SSRF) · medium · GitLab
    72 votes
  43. SSRF and secret key disclosure found on Turbonomic endpointServer-Side Request Forgery (SSRF) · high · IBM
    71 votes
  44. mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Server-Side Request Forgery (SSRF) · critical · Acronis
    $1,00071 votes
  45. Lack of sanitization of the billing address in pdf invoiceServer-Side Request Forgery (SSRF) · high · Semrush
    66 votes
  46. SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)Server-Side Request Forgery (SSRF) · high · arkadiyt-projects
    65 votes
  47. connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scanServer-Side Request Forgery (SSRF) · medium · 8x8
    65 votes
  48. SSRF with information disclosureServer-Side Request Forgery (SSRF) · medium · Lark Technologies
    64 votes
  49. Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addressesServer-Side Request Forgery (SSRF) · medium · Basecamp
    62 votes
  50. External service interaction (HTTP)Server-Side Request Forgery (SSRF) · high · AWS VDP
    62 votes
  51. Blind SSRF External Interaction on ████████Server-Side Request Forgery (SSRF) · high · MTN Group
    61 votes
  52. SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciServer-Side Request Forgery (SSRF) · medium · MTN Group
    60 votes
  53. FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comServer-Side Request Forgery (SSRF) · high · GitLab
    58 votes
  54. Inappropriate URL parsing may cause security risk!Server-Side Request Forgery (SSRF) · medium · Internet Bug Bounty
    $1,00058 votes
  55. SSRF to read AWS metaData at https://█████/ [HtUS]Server-Side Request Forgery (SSRF) · critical · U.S. Dept Of Defense
    $1,00057 votes
  56. SSRF and secret key disclosure found on Turbonomic endpointServer-Side Request Forgery (SSRF) · high · IBM
    56 votes
  57. [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesServer-Side Request Forgery (SSRF) · critical · h1-ctf
    56 votes
  58. Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/formServer-Side Request Forgery (SSRF) · medium · LY Corporation
    $1,35056 votes
  59. SSRF in hatchful.shopify.comServer-Side Request Forgery (SSRF) · low · Shopify
    $50056 votes
  60. Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low · Cloudflare Public Bug Bounty
    54 votes
  61. blind Server-Side Request Forgery (SSRF) allows scanning internal portsServer-Side Request Forgery (SSRF) · medium · Elastic
    54 votes
  62. SSRF By adding a custom integration on console.helium.comServer-Side Request Forgery (SSRF) · high · Helium
    54 votes
  63. Blind SSRF at https://chaturbate.com/notifications/update_push/Server-Side Request Forgery (SSRF) · high · Chaturbate
    54 votes
  64. Blind SSRF vulnerability on cz.acronis.comServer-Side Request Forgery (SSRF) · medium · Acronis
    53 votes
  65. Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Server-Side Request Forgery (SSRF) · medium · Node.js
    52 votes
  66. Unauthenticated full-read SSRF via Twilio integrationServer-Side Request Forgery (SSRF) · high · Rocket.Chat
    52 votes
  67. Bypass of the SSRF protection in Event Subscriptions parameter.Server-Side Request Forgery (SSRF) · medium · Slack
    52 votes
  68. SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCEServer-Side Request Forgery (SSRF) · high · Rockstar Games
    $1,50052 votes
  69. SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XServer-Side Request Forgery (SSRF) · medium · Kubernetes
    $1,00051 votes
  70. Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRFServer-Side Request Forgery (SSRF) · low · Stripe
    51 votes
  71. Internal SSRF bypass using slash commands at api.slack.comServer-Side Request Forgery (SSRF) · medium · Slack
    51 votes
  72. CreatorID leaked from public content posted to SnapMapsServer-Side Request Forgery (SSRF) · medium · Snapchat
    $1,00049 votes
  73. SSRF via User-Controlled Push proxyServer in Notifications Push RegistrationServer-Side Request Forgery (SSRF) · medium · Nextcloud
    48 votes
  74. SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]Server-Side Request Forgery (SSRF) · critical · U.S. Dept Of Defense
    $4,00046 votes
  75. important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)Server-Side Request Forgery (SSRF) · high · Internet Bug Bounty
    $4,92045 votes
  76. Upload profile photo from URLServer-Side Request Forgery (SSRF) · HackerOne
    44 votes
  77. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high · Weblate
    43 votes
  78. Server-Side Request Forgery (SSRF) in Ghost CMS Server-Side Request Forgery (SSRF) · medium · Node.js third-party modules
    43 votes
  79. SSRF in Search.gov via ?url= parameterServer-Side Request Forgery (SSRF) · low · GSA Bounty
    $15043 votes
  80. SSRF on http://www.███████/crossdomain.php via url parameterServer-Side Request Forgery (SSRF) · critical · Sony
    42 votes
  81. SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs CloudbotServer-Side Request Forgery (SSRF) · medium · Logitech
    $20041 votes
  82. SSRF/XSPA in labs.data.gov/dashboard/validateServer-Side Request Forgery (SSRF) · medium · GSA Bounty
    $30041 votes
  83. DNS pin middleware can be tricked into DNS rebinding allowing SSRFServer-Side Request Forgery (SSRF) · medium · Nextcloud
    38 votes
  84. Blind SSRF in Mail AppServer-Side Request Forgery (SSRF) · low · Nextcloud
    37 votes
  85. FULL SSRF Server-Side Request Forgery (SSRF) · low · Acronis
    37 votes
  86. [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without AuthServer-Side Request Forgery (SSRF) · critical · Uber
    $50037 votes
  87. The endpoint '/test/webhooks' is vulnerable to DNS RebindingServer-Side Request Forgery (SSRF) · medium · Omise
    $20036 votes
  88. Injection of `http.<url>.*` git config settings leading to SSRFServer-Side Request Forgery (SSRF) · high · GitLab
    $3,00036 votes
  89. Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hookServer-Side Request Forgery (SSRF) · high · GitLab
    $75036 votes
  90. Blind POST SSRF via Web Push Notification EndpointServer-Side Request Forgery (SSRF) · medium · phpBB
    33 votes
  91. Host header injection that bypassed protection and allowed accessing multiple subdomainsServer-Side Request Forgery (SSRF) · medium · Urban Company
    $50033 votes
  92. SSRF via filter bypass due to lax checking on IPsServer-Side Request Forgery (SSRF) · medium · Nextcloud
    $25033 votes
  93. Blind SSRF in social-plugins.line.meServer-Side Request Forgery (SSRF) · medium · LY Corporation
    $10033 votes
  94. SSRF at ideas.starbucks.comServer-Side Request Forgery (SSRF) · high · Starbucks
    33 votes
  95. SSRF in https://www.zomato.com████ allows reading local files and website source codeServer-Side Request Forgery (SSRF) · critical · Eternal
    32 votes
  96. Open redirect bypass & SSRF Security VulnerabilityServer-Side Request Forgery (SSRF) · Smule
    31 votes
  97. SSRF via potential filter bypass with too lax local domain checkingServer-Side Request Forgery (SSRF) · low · Nextcloud
    $25030 votes
  98. Full read SSRF in flyte-poc-us-east4.uberinternal.comServer-Side Request Forgery (SSRF) · medium · Uber
    $2,00030 votes
  99. SSRF to AWS file readServer-Side Request Forgery (SSRF) · critical · Lab45
    30 votes
  100. /applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API keyServer-Side Request Forgery (SSRF) · high · Valve
    30 votes