CVE-2025-10471

Katalog CVE

CVSS 8.8 · High EPSS 0,31%

Kerentanan Server-Side Request Forgery (SSRF) pada zkeacms. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Rincian

Terbit di NVD

15 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.323890 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.648387 advisory pihak ketiga · vdb entry
• https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md broken link
• https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md#poc broken link
• https://vuldb.com/?ctiid.323890 permissions required · vdb entry