Skip to content
BackEsc
Sign in

connection · two weakness classes

Injection and Smuggling with Server-Side Request Forgery

29 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.

exploited in the wild
1
check available
1
likely to be exploited
2

Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Oracle E-Business Suite - Server-Side Request ForgeryCVE-2025-61884Oracle Corporation · CVSS 7.5 · 96% likely

    CWE-918Oracle

  2. GeoServer WFS - XXE Processing VulnerabilityCVE-2025-30220geoserver · CVSS 9.9 · 44% likely

    CWE-611GeoServer

  3. XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (…CVE-2018-1158615% likely

    CWE-611

  4. An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduc…CVE-2020-854013% likely

    CWE-611

  5. The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly c…CVE-2014-39906.6% likely

    CWE-611

  6. Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesCVE-2022-32533Apache Software Foundation · CVSS 9.8 · 4.2% likely

    CWE-79Apache

  7. XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before…CVE-2017-94582.5% likely

    CWE-611

  8. XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (…CVE-2016-70512.4% likely

    CWE-611

  9. Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175axios · CVSS 4.8 · 2.0% likelycovered by CyberSIXT

    CWE-113Axios

  10. http4k has a potential XXE (XML External Entity Injection) vulnerabilityCVE-2024-55875http4k · CVSS 9.8 · 1.9% likely

    CWE-200Http4k

  11. Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.CVE-2022-244491.9% likely

    CWE-611

  12. I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an a…CVE-2018-10001241.8% likely

    CWE-611

  13. An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded…CVE-2020-157721.2% likely

    CWE-611

  14. Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extra…CVE-2018-10000561.1% likely

    CWE-611

  15. Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, an…CVE-2024-51981Brother Industries, Ltd · CVSS 5.3 · 1.0% likely

    CWE-918Brother Industries, Ltd

  16. Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to…CVE-2018-10000550.8% likely

    CWE-611

  17. Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract…CVE-2018-10000540.8% likely

    CWE-611

  18. Cross-Site Scripting (XSS) vulnerability in SAP Web DispatcherCVE-2024-47590SAP_SE · CVSS 8.8 · 0.8% likely

    CWE-791SAP

  19. WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as…CVE-2020-11885CVSS 4 · 0.8% likely

    CWE-611

  20. A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This fla…CVE-2025-63551Metinfo · CVSS 7.5 · 0.5% likely

    CWE-611

  21. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55791craftcms · CVSS 6.9 · 0.5% likely

    CWE-918CraftCMS

  22. Mastodon Server-Side Request Forgery vulnerabilityCVE-2023-42450mastodon · CVSS 5.4 · 0.5% likely

    CWE-918Mastodon

  23. PowSyBl Core XML Reader allows XXE and SSRFCVE-2025-47293powsybl · CVSS 2.7 · 0.4% likely

    CWE-611Powsybl

  24. Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` setCVE-2026-126062sparklemotion · CVSS 3.7 · 0.4% likely

    CWE-611Sparklemotion

  25. GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)CVE-2024-34711geoserver · CVSS 9.3 · 0.3% likely

    CWE-200GeoServer

  26. XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)CVE-2026-2252Xerox · CVSS 7.5 · 0.3% likely

    CWE-611Xerox

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in