CVE-2025-13872
Critical · 9.1CVSS
9.1
EPSS
0.3%
Published
Dec 2, 2025
CISA due date
—
The record
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|