CWE-610 · Server-Side Request Forgery
Externally Controlled Reference to a Resource in Another Sphere
136CVEs
1exploited
0with a public check
3likely (EPSS 10%+)
SortMost likely exploited
136 CVEs with CWE-610 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-27593In CISA KEVExploitedQNAP QTS Photo Station External Reference - Local File InclusionQNAP Systems Inc. · Photo Station · CVSS 10 · 2022-09-08 | 10.0 | 88% | 2022-09-08 |
| CVE-2017-18357Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, w…Shopware · Shopware · 2019-01-15 | – | 27% | 2019-01-15 |
| CVE-2017-0211An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microso…Microsoft Corporation · Windows OLE · 2017-04-12 | – | 14% | 2017-04-12 |
| CVE-2024-45826ThinManager® Code Execution VulnerabilityRockwell Automation · ThinManager · CVSS 6.8 · 2024-09-12 | 6.8 | 12% | 2024-09-12 |
| CVE-2021-26920Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedApache Software Foundation · Apache Druid · 2021-07-02 | – | 9.5% | 2021-07-02 |
| CVE-2021-30245Code execution in Apache OpenOffice via non-http(s) schemes in HyperlinksApache Software Foundation · Apache OpenOffice · 2021-04-15 | – | 4.9% | 2021-04-15 |
| CVE-2021-43844Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirectrcmaehl · MSEdgeRedirect · CVSS 8.8 · 2021-12-20 | 8.8 | 3.4% | 2021-12-20 |
| CVE-2017-16088The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectiv…HackerOne · safe-eval node module · 2018-06-07 | – | 3.4% | 2018-06-07 |
| CVE-2021-41244Cross organization admin control in Grafanagrafana · grafana · CVSS 9.1 · 2021-11-15 | 9.1 | 2.9% | 2021-11-15 |
| CVE-2021-27648Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to…Synology · Synology Antivirus Essential · CVSS 9 · 2021-04-28 | 9.0 | 2.8% | 2021-04-28 |
| CVE-2021-27183An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new…Altn · Mdaemon · 2021-04-14 | – | 2.7% | 2021-04-14 |
| CVE-2020-14057Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to g…Monstaftp · Monsta Ftp · 2020-07-01 | – | 2.6% | 2020-07-01 |
| CVE-2023-0045Incorrect indirect branch prediction barrier in the Linux KernelLinux · Linux Kernel · CVSS 4.7 · 2023-04-25 | 4.7 | 2.4% | 2023-04-25 |
| CVE-2022-39206CI/CD Docker Escape in OneDevtheonedev · onedev · CVSS 9.9 · 2022-09-13 | 9.9 | 2.2% | 2022-09-13 |
| CVE-2021-26711A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/def…Redwood · Report2web · 2021-02-05 | – | 1.9% | 2021-02-05 |
| CVE-2018-12381Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note…Mozilla · Firefox ESR · 2018-10-18 | – | 1.8% | 2018-10-18 |
| CVE-2024-47773Anonymous cache poisoning via XHR requests in Discoursediscourse · discourse · CVSS 8.2 · 2024-10-08 | 8.2 | 1.8% | 2024-10-08 |
| CVE-2021-44041UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This al…Uipath · Assistant · 2021-12-14 | – | 1.8% | 2021-12-14 |
| CVE-2017-15269The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. These can be performed using "nmap -b" and allow performing scans via the FTP server.Psftp · Psftpd · 2017-11-15 | – | 1.5% | 2017-11-15 |
| CVE-2022-30245Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then im…Honeywell · Alerton Compass · 2022-07-15 | – | 1.4% | 2022-07-15 |
| CVE-2022-45918ILIAS before 7.16 allows External Control of File Name or Path.Ilias · Ilias · 2022-12-07 | – | 1.3% | 2022-12-07 |
| CVE-2021-43685libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename…Libretime · Libretime Hv · 2021-12-01 | – | 1.2% | 2021-12-01 |
| CVE-2021-3779Ruby-MySQL Gem Client File ReadTomita Masahiro · ruby-mysql · 2022-06-28 | – | 1.2% | 2022-06-28 |
| CVE-2022-24854Database bypassing any permissions in Metabase via SQlite attachmetabase · metabase · CVSS 8 · 2022-04-14 | 8.0 | 1.1% | 2022-04-14 |
| CVE-2021-43794Anonymous user cache poisoning via development-mode header in Discoursediscourse · discourse · CVSS 5.3 · 2021-12-01 | 5.3 | 1.1% | 2021-12-01 |
| CVE-2019-7290An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumvent sandbox restricti…Apple · Shortcuts · 2019-12-18 | – | 1.0% | 2019-12-18 |
| CVE-2022-24241ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.Aceware · Aceweb Online Portal · 2022-05-27 | – | 1.0% | 2022-05-27 |
| CVE-2020-8226A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.Phpbb · https://github.com/phpbb/phpbb · 2020-08-17 | – | 1.0% | 2020-08-17 |
| CVE-2018-7824An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bi…Schneider · Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and… · 2019-05-22 | – | 0.9% | 2019-05-22 |
| CVE-2024-24760Mailcow Docker Container Exposure to Local Networkmailcow · mailcow-dockerized · CVSS 8.8 · 2024-02-02 | 8.8 | 0.9% | 2024-02-02 |
| CVE-2020-21363An arbitrary file deletion vulnerability exists within Maccms10.Maccms · Maccms · 2021-08-11 | – | 0.8% | 2021-08-11 |
| CVE-2022-43428Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to con…Jenkins project · Jenkins Compuware Topaz for Total Test Plugin · CVSS 5.3 · 2022-10-19 | 5.3 | 0.8% | 2022-10-19 |
| CVE-2022-43423Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, al…Jenkins project · Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin · CVSS 5.3 · 2022-10-19 | 5.3 | 0.8% | 2022-10-19 |
| CVE-2025-22144Account Takeover in NamelessMCNamelessMC · Nameless · CVSS 9 · 2025-01-13 | 9.0 | 0.8% | 2025-01-13 |
| CVE-2021-29965A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead…Mozilla · Firefox · 2021-06-24 | – | 0.7% | 2021-06-24 |
| CVE-2022-3032When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified…Mozilla · Thunderbird · 2022-12-22 | – | 0.7% | 2022-12-22 |
| CVE-2024-52792Arbitrary config values override in lamLDAPAccountManager · lam · CVSS 6.5 · 2024-12-17 | 6.5 | 0.7% | 2024-12-17 |
| CVE-2023-35838The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. T…Wireguard · Wireguard · 2023-08-09 | – | 0.7% | 2023-08-09 |
| CVE-2020-23171A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in t…Nim-Lang · Nim-Lang · 2021-08-10 | – | 0.7% | 2021-08-10 |
| CVE-2026-34327Microsoft Partner Center Spoofing VulnerabilityMicrosoft · Microsoft Partner Center · CVSS 8.2 · 2026-05-07 | 8.2 | 0.6% | 2026-05-07 |
| CVE-2023-4089WAGO: Multiple products vulnerable to local file inclusionWAGO · Compact Controller CC100 · CVSS 2.7 · 2023-10-17 | 2.7 | 0.6% | 2023-10-17 |
| CVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to…Jenkins Project · Jenkins OWASP ZAP Plugin · CVSS 8.8 · 2026-06-24 | 8.8 | 0.6% | 2026-06-24 |
| CVE-2026-0522Local File Inclusion in the File Upload/Download ProcessVertiGIS · VertiGIS FM · CVSS 7.4 · 2026-04-01 | 7.4 | 0.6% | 2026-04-01 |
| CVE-2024-24818EspoCRM weakness in "Forgot password"espocrm · espocrm · CVSS 5.9 · 2024-02-29 | 5.9 | 0.6% | 2024-02-29 |
| CVE-2018-12475obs-service-download_files allows downloading from localhost or intranet hostsopenSUSE · Open Build Service · CVSS 6.5 · 2020-09-01 | 6.5 | 0.6% | 2020-09-01 |
| CVE-2023-37856PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panelsPHOENIX CONTACT · WP 6070-WVPS · CVSS 4.3 · 2023-08-09 | 4.3 | 0.6% | 2023-08-09 |
| CVE-2023-37855PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panelsPHOENIX CONTACT · WP 6070-WVPS · CVSS 4.3 · 2023-08-09 | 4.3 | 0.6% | 2023-08-09 |
| CVE-2015-10142Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathSitecore · Experience Platform (XP) · CVSS 6.9 · 2025-07-25 | 6.9 | 0.6% | 2025-07-25 |
| CVE-2020-0267In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app inste…Google · Android · 2020-09-17 | – | 0.5% | 2020-09-17 |
| CVE-2026-15583SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL headerGrafana · Grafana MCP Server · CVSS 8.6 · 2026-07-15 | 8.6 | 0.5% | 2026-07-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.