CVE-2020-25466

Critical · CVSS 9.8

CRMEB — Server-Side Request Forgery (SSRF) leading to Remote Code Execution

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-918

Description

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.

Search profile — drives PoC discovery

Symbols downloadimagedownloadImagedownload_imageCRMEB

Keywords CVE-2020-25466CRMEB SSRFCRMEB downloadimageCRMEB 3.0 SSRFCRMEB RCECRMEB arbitrary file downloadCRMEB remote code execution

Versions: 3.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

crmeb/CRMEB candidate

cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z