CVE-2025-13872

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-918

Description

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

References

https://www.objectplanet.com/opinio/changelog.html

Status: profiled · ingested 2026-09-26T06:00:02.000Z