Skip to content
BackEsc
Sign in

weakness in Server-Side Request Forgery

Server-Side Request Forgery (SSRF)

293 disclosed reports · $169,546 paid

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

reports
293
paid a bounty
90

Every one of the 293 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. SSRF in Exchange leads to ROOT access in all instances#341876Shopify · 587 votes
  2. Server Side Request Forgery (SSRF) via Analytics Reports#2262382HackerOne · $25,000 · 529 votes
  3. Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata#530974Snapchat · 421 votes
  4. Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosure#923132Dropbox · $4,913 · 360 votes
  5. SSRF on project import via the remote_attachment_url on a Note#826361GitLab · $10,000 · 359 votes
  6. Server Side Request Forgery mitigation bypass#632101GitLab · 350 votes
  7. Blind SSRF to internal services in matrix preview_link API#1960765Reddit · $6,000 · 344 votes
  8. TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services#333419Slack · $3,500 · 323 votes
  9. Full Response SSRF via Google Drive#1406938Dropbox · $17,576 · 302 votes
  10. SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]#549882Vimeo · 276 votes
  11. SSRF on fleet.city-mobil.ru leads to local file read#748069Mail.ru · 272 votes
  12. Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusion#1189367Evernote · 264 votes
  13. SSRF in graphQL query (pwapi.ex2b.com)#1864188EXNESS · $3,000 · 261 votes
  14. Unauthenticated blind SSRF in OAuth Jira authorization controller#398799GitLab · $4,000 · 238 votes
  15. SSRF & LFR on city-mobil.ru#748128Mail.ru · 237 votes
  16. Full Read SSRF on Gitlab's Internal Grafana#878779GitLab · 229 votes
  17. SSRF in webhooks leads to AWS private keys disclosure#508459Omise · 214 votes
  18. Stored XSS & SSRF in Lark Docs#892049Lark Technologies · $3,000 · 178 votes
  19. SSRF on duckduckgo.com/iu/#398641DuckDuckGo · 165 votes
  20. Server Side Request Forgery#644238Lark Technologies · 164 votes
  21. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing#1062888TikTok · $2,727 · 162 votes
  22. SSRF in Autodesk Rendering leading to account takeover#3024673Autodesk · 161 votes
  23. SSRF chained to hit internal host leading to another SSRF which allows to read internal images.#826097PlayStation · $1,000 · 148 votes
  24. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool#3176157PortSwigger Web Security · 144 votes
  25. Blind SSRF on errors.hackerone.net due to Sentry misconfiguration#374737HackerOne · $3,500 · 143 votes
  26. SSRF in https://couriers.indrive.com/api/file-storage#2300358inDrive · 141 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in