CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025

High · published July 21, 2025

CVSS v3.1
8.6
EPSS
2%
Percentile
77.7
In the wild
Unconfirmed
What it is

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01750 · 77.7th percentile
Published
2025-07-21T00:00Z
EPSS history
Timeline
  • 21 JUL 00:00Z
    An issue was discovered in Eveo URVE Web Manager 27.02.2025
    cvelistv5