Dashboard / CVE-2025-63551

CVE-2025-63551

HIGH
MEDIUM Priority: 0.04 BB Relevance: 75/100
Published: 2025-11-06 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
metinfo metinfo < 8.1

References & Advisories (2)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.51%
Raw Score 0.005050
Percentile 43.4%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00505
2026-11-08
0.00505
2026-11-07
0.00505
2026-11-06
0.00505
2026-11-05
0.00505

Intelligence Sources

nvd ref →

External Links