EUVD-2025-20180Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required; SSRF yields limited confidentiality and integrity impact on the vulnerable system only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Server-side request forgery in BoyunCMS up to version 1.4.20 allows remote authenticated attackers to issue arbitrary server-side HTTP requests through the payment component's curl processing. Public exploit code is available, though no active exploitation has been confirmed and the EPSS score remains low at 0.04%.
Technical ContextAI
BoyunCMS is a PHP-based content management system. The vulnerability resides in the /application/pay/controller/Index.php file, where improper validation of user-supplied input passed to curl leads to CWE-918 Server-Side Request Forgery. This allows an attacker to force the server to make requests to internal or external systems. The affected CPE is cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:*, covering all versions up to 1.4.20.
RemediationAI
No vendor-released patch is identified at time of analysis. As an immediate mitigation, restrict network access to the /application/pay/controller/Index.php endpoint to only trusted users, or disable the payment module if not required. Implement egress filtering to prevent the web server from making arbitrary outbound connections to internal networks. Consider upgrading to a later release once available. Monitor the VulDB entry (https://vuldb.com/?id.315017) for update notifications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today