Vulnerability · Published Dec 2, 2025 · Assigned by TCS-CERT
CVE-2025-13872Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio
Low 2.1
In plain English
A low-severity server-side request forgery in Opinio from ObjectPlanet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ObjectPlanet | Opinio | 7.26 rev12562 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
References
- https://www.objectplanet.com/opinio/changelog.html release-notes