CVE-2025-13796

LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2025-12-01 cna@vuldb.com

SSRF

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 18:17 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

CVE Published

Dec 01, 2025 - 00:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.120.2 addresses this issue. It is suggested to upgrade the affected component.

AnalysisAI

Server-side request forgery in deco-cx apps 0.120.1 and earlier allows a low-privileged remote attacker to manipulate the url parameter in the AnalyticsScript loader, forcing the server to fetch arbitrary URLs. This can result in low-impact information disclosure, internal network reconnaissance, or interaction with internal services. A public exploit exists, but there is no evidence of active exploitation (EPSS 0.05%); upgrading to version 0.120.2 removes the vulnerable parameter.