THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-13872 (CRITICAL 9.1) — Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

[NVD] CVE-2025-13872 (CRITICAL 9.1) — Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

lownvdPublished 2025-12-02

CVE-2025-13872 CVSS: 9.1 CRITICAL Published: 2025-12-02T10:16:01.877

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of

ObjectPlanet Opinio 7.26 rev12562 on

Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests

to an arbitrary destination.

Indicators of compromise

CVE-2025-13872cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-13872