CVE-2025-13872
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
Risk Assessment
The risk includes potential use of the server to attack internal network resources, which could lead to disclosure of sensitive information or further compromise.
Recommendation
It is recommended to update to the latest version of the software and restrict access to the survey import feature to trusted users only.
Other vulnerabilities in ObjectPlanet Opinio
See all- CVE-2025-13873Medium
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
- CVE-2025-13871High
A Cross-Site Request Forgery (CSRF) vulnerability in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows uploading files on behalf of connected users and then accessing those files without authentication.
Original NVD description (English source)
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS