CVE-2025-57055

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator ca...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory github.com
advisory nvd.nist.gov
package github.com