CVE-2025-13872

CriticalCVSS 9.1

Published: 02/12/2025(UTC)Updated: 03/09/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

Risk Assessment

The risk includes potential use of the server to attack internal network resources, which could lead to disclosure of sensitive information or further compromise.

Recommendation

It is recommended to update to the latest version of the software and restrict access to the survey import feature to trusted users only.

Other vulnerabilities in ObjectPlanet Opinio

CVE-2025-13873Medium
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

Original NVD description (English source)

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.