CVE-2025-10695

MEDIUM

OpenSupports 4.11.0 Diagnostics - Unauthenticated Server-Side Request Forgery

Title source: manual

Description

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.

References (2)

Core 2

Core References

Exploit, Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/freer

Product product

https://github.com/opensupports/opensupports

View Writeup ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0027

EPSS Percentile 19.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

opensupports/opensupports 4.11.0

Published Oct 03, 2025

Tracked Since Feb 18, 2026